PHP2Shell: What Happened to PHP in October 2026?

On 21 October 2026, the PHP development team released an urgent security update addressing two critical vulnerabilities in the programming language.

The vulnerabilities, collectively known as PHP2Shell, potentially allowed attackers to execute malicious code on vulnerable servers without needing a username, password or access to the application itself.

For a language powering millions of websites and applications, this was a serious security concern.

But what actually happened? How could an attacker exploit PHP itself? And more importantly, what should developers do to protect their applications?

Let's break it down.

What Exactly Happened?

PHP is a server-side programming language used to build websites and web applications. Whether you're creating a simple contact form, an e-commerce website or a complex application using Laravel or Symfony, PHP handles instructions behind the scenes.

Like any software, PHP occasionally contains bugs.

Most bugs cause relatively minor problems, such as unexpected behaviour or error messages. However, some bugs create security vulnerabilities that attackers can exploit.

In October 2026, two particularly dangerous vulnerabilities were disclosed:

• CVE-2026-109618: A memory corruption vulnerability involving PHP's handling of out-of-memory errors.
• CVE-2026-109619: A vulnerability involving internal PHP information remaining accessible after its memory should have been released.

Both received a critical security severity score of 9.2 out of 10.

The concerning part? Under certain conditions, attackers could exploit these vulnerabilities without authenticating.

What Is Remote Code Execution?

One of the biggest concerns surrounding PHP2Shell was the possibility of Remote Code Execution (RCE).

To understand this, imagine your website is a restaurant.

Your visitors are customers who can order from the menu. They can interact with your application, but they shouldn't have access to the kitchen or be allowed to change how the restaurant operates.

Remote code execution is rather like a customer finding a hidden entrance into the kitchen and gaining the ability to give instructions to the staff.

In technical terms, an attacker could potentially execute commands on your server that you never intended to permit.

Depending on the server's configuration and permissions, this could lead to stolen information, modified website files or further attacks against connected systems.

Importantly, a vulnerability allowing RCE doesn't automatically mean every affected server has been compromised. It means there is a potential route for attackers to gain control.

How Did PHP2Shell Work?

You don't need to understand complicated memory management to appreciate the problem.

Whenever PHP processes a web request, it uses the server's memory to store information temporarily.

Normally, PHP allocates memory, performs its work and releases that memory when it's no longer needed.

However, the PHP2Shell vulnerabilities involved situations where this process didn't work correctly.

The first vulnerability could occur when PHP encountered a memory allocation failure while processing a request. Under certain circumstances, PHP could attempt to clean up information that hadn't been properly initialised.

The second involved PHP retaining references to memory that had already been released. A later request could accidentally access this outdated information.

Attackers could deliberately create conditions that triggered these problems.

By carefully manipulating the affected memory, an attacker could potentially cause PHP to execute malicious instructions.

The important thing to understand is that the vulnerabilities existed within PHP itself, rather than within the code developers had written.

Were Laravel, Symfony and WordPress Affected?

Potentially, yes.

Because the vulnerabilities existed in PHP's underlying runtime, applications built using popular frameworks and content management systems could also be exposed.

This included applications using:

• Laravel
• Symfony
• WordPress
• Drupal
• Joomla
• Custom PHP applications

However, using one of these platforms didn't automatically mean your website had been compromised.

The risk depended on factors including your installed PHP version, server configuration and whether the vulnerable functionality could be reached.

The PHP team identified several affected server environments, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

This highlights an important distinction: updating Laravel, Symfony or WordPress alone wouldn't necessarily solve the problem.

You needed to update the PHP runtime running underneath your application.

Which PHP Versions Were Vulnerable?

The PHP team released security updates on 21 October 2026.

The following versions contain fixes for the two vulnerabilities:

PHP Branch	Minimum Fixed Version
PHP 8.2	8.2.35
PHP 8.3	8.3.36
PHP 8.4	8.4.27
PHP 8.5	8.5.12

Earlier releases within these branches were vulnerable.

PHP 8.1 and older versions were also affected but no longer received normal upstream security releases. Some operating system vendors provided their own security patches, known as backports.

Developers running older PHP versions should plan to move to a supported version rather than relying indefinitely on legacy software.

How Can You Check Your PHP Version?

If you have access to your development environment or server, open a terminal and run:

php -v

This displays the version of PHP available through your command line.

For example:

PHP 8.4.27 (cli)

However, there's an important catch.

The PHP version used by your command line isn't necessarily the same version serving your website.

If you're using Docker, check the PHP version inside the running application container.

Similarly, shared hosting providers may manage PHP separately from the environment you can access through SSH.

Always confirm the version actually handling web requests.

How Can Developers Protect Their Applications?

The most important action is to install a patched PHP release.

Beyond that, developers should adopt a few straightforward security practices.

1. Keep PHP Updated

Use supported PHP versions and install security releases promptly. Don't assume an application is safe simply because it continues working normally.

2. Check Your Hosting Environment

If you're using managed hosting, confirm that your provider has applied the necessary patches.

3. Update Your Docker Images

If your application runs in Docker, ensure you're using an updated PHP image. Rebuild and redeploy your containers so the patched runtime is actually running.

4. Keep Frameworks and Dependencies Updated

Although updating Laravel or Symfony doesn't directly fix PHP2Shell, outdated packages can introduce their own vulnerabilities.

5. Monitor Your Applications

Review application and server logs for unusual activity. Monitoring helps identify suspicious behaviour, although it doesn't replace installing security patches.

Security is an ongoing responsibility, not something you configure once and forget about.

What Can We Learn From PHP2Shell?

Perhaps the biggest lesson from PHP2Shell is that writing secure application code is only one part of protecting a website.

You could follow every best practice, validate user input, protect against SQL injection and use a well-maintained framework.

Yet your application could still be exposed because of a vulnerability in the underlying software.

That's why developers need to think beyond their own code.

Understanding your hosting environment, keeping software updated and recognising security announcements are all essential development skills.

The good news is that the PHP team responded with security releases, providing a clear route to protecting affected installations.

The takeaway?

You don't need to become a cybersecurity expert overnight.

But you should know what software your application relies on, understand the importance of security updates and never assume that working software is automatically secure.

Because sometimes, the biggest vulnerability isn't in the code you've written. It's in the software running it.