PHP2Shell: Critical PHP Vulnerabilities and How to Patch Your Server

Two critical PHP flaws, known as PHP2Shell, let attackers run code on web servers. Here’s which PHP versions fix them and how to patch a cPanel/WHM server.

Supreme Servers Team · 4 min read · Updated

PHP2Shell security alert: critical PHP flaws CVE-2026-109618 and CVE-2026-109619, patch now

On October 21, 2026, the PHP project released emergency security updates for two critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both let an attacker run code on a web server without logging in. Attacks were seen before the patches shipped, so if your server runs PHP, update it now. This guide explains what PHP2Shell is, which versions fix it, and how to patch a cPanel/WHM server.

What is PHP2Shell?

PHP2Shell is the name for two remote code execution (RCE) vulnerabilities in PHP itself, not in WordPress or a plugin:

  • CVE-2026-109618: remote code execution through memory corruption when PHP runs out of memory.
  • CVE-2026-109619: remote code execution through “stale global state” left behind after a request ends abnormally.

The PHP project rates both as critical. In each case an attacker can run commands on your server with the same permissions as the account that runs PHP, which is usually enough to change your website, steal data or install malware.

Is my server affected?

Almost certainly, if it runs PHP and hasn’t been updated since October 21. The flaws affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed. The PHP team says the risk is highest with mod_php, where an attacker doesn’t need to reach any application code at all.

Is PHP2Shell being exploited?

Yes. Cloudflare reported attacks against both flaws before the fixes were released, and the UK’s National Cyber Security Centre (NCSC) has urged organizations to update immediately. Treat this as urgent, even if your website seems to be working normally.

Which PHP versions fix it?

Update to one of these versions or newer:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

PHP 8.1 and older no longer get official releases, although some operating system vendors and control panels have released their own patched packages. If you’re on PHP 7.x or older, plan your move to PHP 8.2 or newer now. PHP 8.2 itself reaches end of life on December 31, 2026, so PHP 8.3 or newer is the better choice.

How to patch PHP on a cPanel/WHM server

On cPanel/WHM, PHP comes from EasyApache 4. The patched packages are ea-php82 8.2.35, ea-php83 8.3.36, ea-php84 8.4.27 and ea-php85 8.5.12. cPanel has also released fixes for ea-php74, ea-php80 and ea-php81 that keep their old version numbers.

  1. Log in to your server over SSH as root.
  2. Update the EasyApache PHP packages with dnf update 'ea-php*' (or yum update 'ea-php*' on older systems).
  3. Restart the web server and PHP-FPM, for example with /scripts/restartsrv_httpd and /scripts/restartsrv_apache_php_fpm.
  4. Check which PHP versions your websites use in WHM under Software > MultiPHP Manager, and move any site on PHP 7.4 or older to PHP 8.3 or newer.
  5. For versions that keep their old number, confirm the fix with rpm -q --changelog ea-php81-php-cli | grep -E '109618|109619' (change ea-php81 to your version). No output means that version still needs updating.

Our guide on how to add PHP modules in cPanel/WHM walks through the EasyApache 4 and MultiPHP screens if you’re new to them. On a server without a control panel, update PHP with your operating system’s package manager (for example dnf update php* on AlmaLinux or Rocky Linux, or apt upgrade on Ubuntu and Debian), then restart PHP-FPM and your web server.

Is there a workaround if I can’t update right away?

Only partly. The PHP project lists settings that reduce the risk, such as setting session.upload_progress.enabled = 0 and lowering post_max_size, and some web application firewalls block known attack patterns. These don’t fully protect your server. Installing the updated PHP version is the only permanent fix.

What should Supreme Servers customers do?

  • Cloud VPS with cPanel/WHM or Plesk: your VPS is fully managed. If you’d like us to confirm which PHP versions your websites use and that they’re patched, open a support ticket.
  • Dedicated servers, and Cloud VPS without a control panel: you have full root or administrator access, so install the PHP updates yourself as described above. If you need help, open a support ticket.

Our support team is available 24/7/365 by support ticket in the Client Area. If you’d rather not manage PHP updates yourself, adding cPanel/WHM or Plesk to your Cloud VPS means we fully manage the server for you.

Sources

Questions about your servers?

Tell us what you run and our team will get back to you. Accurate technical advice, no hard sell.

    We use your details to reply to you, and only send news if you tick the box. Existing customer? Open a support ticket instead. Protected by reCAPTCHA: Google’s Privacy Policy and Terms apply.