A website can run an up-to-date version of Drupal, WordPress or Joomla and still be vulnerable because of its PHP version. PHP2Shell refers to two critical vulnerabilities in the PHP engine, with a CVSS score of 9.2. Fixes were released on October 21, 2026. Source: PHP Foundation.
How the problem occurs
Both vulnerabilities involve memory management:
- CVE-2026-109618: running out of memory can interrupt PHP while internal structures are only partially initialized. Processing them later can corrupt memory.
- CVE-2026-109619: a request can leave references to freed memory that a later request uses again.
Under certain conditions, an attacker without an account can execute code with the web process’s privileges or access sensitive data in memory. The problem is in PHP itself, so custom applications can also be affected. Sources: OOM advisory, global state advisory, PHP2Shell.
Can anyone attack a website using AI?
Public AI services have filters and safeguards designed to block their use for cyberattacks. Having access to a chatbot does not automatically give someone without an IT background, or a “vibe coder”, the ability to exploit PHP2Shell. Example: Anthropic’s safeguards.
Developing an exploit and adapting it to a particular server requires an understanding of PHP, memory and the target’s configuration. Experienced people can combine this expertise with specialized tools, including custom AI systems. However, owning a custom AI system is not a requirement, and safeguards in public services are not an absolute guarantee. Wiz research.
For someone running a personal blog, the existence of this vulnerability does not automatically mean they are being targeted. A targeted attack requires motivation, time and resources; government institutions and public figures may attract interest for such operations. However, we have no data showing that they are the main PHP2Shell targets. A small website can also be discovered automatically, so updating remains necessary.
How to fix it
Update PHP, then restart the services and workers that use it. The first patched versions are:
- PHP 8.2: 8.2.35
- PHP 8.3: 8.3.36
- PHP 8.4: 8.4.27
- PHP 8.5: 8.5.12
Later releases that include the fix are also suitable. For Linux packages with backported patches, check the vendor’s advisory. Source: PHP.
Steps for your server
Warning: make these changes only if you have experience administering servers. Updates and restarts can interrupt hosted websites. Prepare a verified backup and test compatibility. If you are unsure, ask your administrator or hosting provider for help.
cPanel / WHM
In cPanel → MultiPHP Manager, select the domain, choose a compatible, patched PHP branch and click Apply. Selecting “8.4” alone does not confirm that the patch is installed: the administrator must check the full package version. PHP installations are managed through WHM → EasyApache 4; update the packages and restart the relevant PHP services. Without WHM access, ask your provider to confirm that both CVEs have been addressed. Documentation: MultiPHP Manager, EasyApache 4.
Linux: Ubuntu / Debian and AlmaLinux
On Ubuntu/Debian, use APT to update all installed PHP packages for the branch in use, including extensions. Restart the corresponding PHP-FPM service; if you use Apache with mod_php, restart Apache. Package and service names depend on your installation. Ubuntu documentation.
For standard AlmaLinux packages, the vendor recommends:
sudo dnf upgrade 'php*'sudo systemctl restart php-fpm
With mod_php, restart httpd instead of PHP-FPM. For installations with package prefixes or other RHEL distributions, adapt the commands according to the vendor’s documentation. Confirm the patch using the distribution’s advisory: the base version may stay the same because of backporting. AlmaLinux instructions.
Docker and other hosting panels
In Docker, choose an image containing the fix, pull it or rebuild your own image using the updated base, then recreate the containers. A simple restart keeps the old image. Documentation: build, recreating containers.
In Plesk, check the version assigned to the domain under PHP Settings and ask the administrator to update the runtime if the patched version is missing. With managed hosting, request confirmation that both CVEs have been patched. Plesk documentation.
After making changes, check the PHP runtime actually used by the web server, which can differ from the terminal version, and test authentication, forms and uploads on every instance.
Updating the CMS alone does not update PHP. A WAF or temporary configuration changes may reduce some risks, but they do not replace the patch. Source: PHP2Shell guidance.