PHP2Shell: Am I Affected, and How Do I Patch It?

What is PHP2Shell?

CVE-2026-109618 and CVE-2026-109619 are PHP runtime vulnerabilities that can permit remote code execution without authentication. PHP's announcement covers web-serving installations, including FPM and Apache; patch the runtime rather than relying on a WordPress plugin update.

Am I affected?

Distribution packages keep their own numbers: Ubuntu's patched PHP 8.3 package is 8.3.6-0ubuntu0.24.04.13. Compare the full package build with USN-8948-1, rather than treating an older-looking number as proof of exposure.

First, find your PHP version

php -v

Also check the web runtime: CLI and FPM can differ. Follow the PHP version checks for WordPress, panels and containers.

Patch steps by environment

Ubuntu and Debian

Back up and arrange a maintenance window. Review the packages offered by your configured repositories, install updates, then restart the actual FPM services or Apache handler used by every site. Replace service placeholders with installed service names.

sudo apt update && sudo apt upgrade
# Identify installed PHP services before restarting them:
systemctl list-units --type=service 'php*'
# Example pattern only: sudo systemctl restart <your-php-fpm-service>

cPanel / WHM

Refresh repository metadata using the OS-specific instructions in cPanel's advisory, then run the package updater as administrator. Check every domain in MultiPHP Manager, including domains pinned to a non-default branch.

/scripts/update-packages
# RPM systems; replace ea-php84 with each installed branch:
rpm -q --changelog ea-php84-php-cli | grep -m1 CVE-2026-109618
# On Ubuntu, use the changelog path in the cPanel advisory instead.

Docker and WordPress containers

For a custom PHP image, select a fixed full-version tag such as php:8.4.27-fpm-alpine, rebuild with docker build --pull, and recreate all affected web, queue and cron containers. Check the published tag and supported architecture before selecting it.

For a WordPress Compose service, pull and recreate it, then verify the running container. Pulling an image alone does not start a new container.

docker compose pull wordpress && docker compose up -d wordpress
docker compose exec wordpress php -v

Plesk, RHEL, AlmaLinux, Rocky and other vendors

Use your vendor's current security advisory for the installed PHP package and repository. The upstream table does not certify vendor builds or third-party repositories. Ask support for a package build covering both CVEs; avoid switching repositories simply to match a version string.

Shared hosting and managed WordPress

Ask your host to confirm the patched build serving each domain and restart coverage. If a branch change is needed, follow the WordPress PHP upgrade checklist before switching.

After patching: restart and verify

1. Restart all affected workers, including background containers.
2. Check CLI and the web runtime independently, and confirm vendor backports from the full package build.
3. Test login, forms, uploads and scheduled jobs.

Amazon's October 21 report recommends reviewing logs and unexpected process execution or file changes, investigating from at least 2026-10-17. Suspected compromise needs incident response; installing a patch alone does not remove an intrusion.

If you cannot patch today

These measures reduce exposure to known attack paths; they do not make PHP safe. Have the server administrator apply and review them using the complete PHP advisory.

• Set session.upload_progress.enabled=0 before request parsing and restart all workers. Application ini_set() and FPM .user.ini are insufficient.
• For the newest supported branch, review the advisory's fatal_error_backtraces setting.
• Read the official advisory before changing memory limits. PHP suggests memory_limit=-1 with external container/cgroup boundaries; this is not a generic resource tuning recommendation. Do not substitute RLIMIT_AS or RLIMIT_DATA.
• Review request-size limits and upload requirements with your administrator. Hiding errors does not fix the vulnerability.

Amazon also discusses temporarily restricting multipart uploads after checking the effect on the application. Follow Cloudflare's coverage notice if using that WAF, and continue the patch process.

Disclosure and response timeline

Times shown with hours are UTC. Reports describe observations at their publication time, not proof that every attempt succeeded.

Change log

2026-10-23: Initial guide; reviewed upstream fixes, distribution packages, cPanel instructions and runtime verification.