PHP Critical security update PHP2Shell

What has happened?

PHP have announced that they will be making a critical security release at 14:00 UTC (15:00 UK time) today (Wednesday, 21 October):

https://www.php.net/archive/2026.php#2026-10-20-1

It is believed that this release will patch two remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have become known as PHP2Shell.

Is my server vulnerable?

If you run PHP version 5.4 or later on your server, then it is likely vulnerable.

What is the impact?

Exploitation of these vulnerabilities could result in remote attackers being able to execute code on your server, with the privileges of the user running PHP.

Is this vulnerability being actively exploited?

Cloudflare are apparently seeing early attacks emerging. There have been suggestions that widespread attacks could begin shortly after the official release.

Which PHP versions are these vulnerabilities fixed in?

We believe that the following upcoming PHP versions will contain fixes for these vulnerabilities:

8.2.35 8.3.36 8.4.27 8.5.12 However, this has not yet been officially announced.

Linux distributions and control panels (e.g. Plesk and cPanel) may backport patches for earlier PHP versions that they support.

We will provide an update once fixed versions have been confirmed.

Is there a mitigation available?

The following settings in php.ini have been suggested as a potential mitigation:

session.upload_progress_enabled = Off session.use_strict_mode = 1

See https://www.php.net/manual/en/session.configuration.php for documentation of these settings.

However, it is not confirmed that these mitigations are effective, so we still strongly recommend installing PHP updates as soon as they are made available.

Cloudflare are deploying WAF rules for known exploit vectors, so sites behind Cloudflare with WAF enabled are at least partially protected.

What actions are CWCS taking?

We are carefully monitoring these vulnerabilities as more details emerge, and will take action as we deem appropriate, including:

Deploying mitigations on production systems. Updating production and managed customer servers as a priority once patches become available. What should I do?

If you have a server running PHP, you should install any updates as soon as they become available. You may want to consider the mitigations above in the meantime.

If you are running and end-of-life (EOL) version of PHP, we strongly recommend upgrading to a supported version (i.e. 8.2 or higher) as soon as possible.