PHP2Shell: Vulnerable PHP Versions, Emergency Patches and WAF Protection

Security guidance checked 22 October 2026. This article covers CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The immediate priority is to deploy a PHP release containing both fixes, verify the runtime serving your website, and keep appropriate WAF protections active while you investigate exposure.

The Guardian reported widespread exploitation attempts on 22 October. See the Guardian report. For technical decisions, use the PHP maintainers’ advisories and your hosting or operating-system vendor’s update notice.

Patch first; use the WAF as an additional defensive layer. A blocked request is useful evidence of filtering. It is not proof that the underlying server is fixed, or that earlier requests caused no harm.

What is PHP2Shell, and why is it urgent?

These flaws affect PHP itself rather than a particular CMS plugin. The NSA advisory warns that exploitation could give an unauthenticated attacker control of an affected web server, enabling data theft, service disruption or further movement into a network. An attacker does not need a WordPress administrator account for a runtime-level attack.

The two CVEs describe different unsafe memory lifecycles:

CVE-2026-109618: Out-of-memory corruption

An allocation failure interrupts work while internal request state is incomplete; cleanup can then use that state incorrectly. A demonstrated Apache mod_php attack path runs before application code starts.

CVE-2026-109619: Stale global state

A worker retains a reference to request-owned memory after that memory has been released; a later request can encounter the stale state. The dangerous state can span requests handled by the same worker.

The OOM advisory explains the first mechanism; the stale-state advisory explains the second. Neither is simply an SQL injection bug that a developer can fix by adding an input sanitizer.

PHP’s security release notice includes PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed in the affected web-serving environments. It identifies mod_php as the highest-risk demonstrated case. Exact exploitability depends on the runtime, configuration and reachable paths; using FPM instead of mod_php does not establish that a server is safe.

Vulnerable PHP versions and the releases to install

The table below describes unpatched upstream releases within each branch. The fixed versions are the first releases containing both fixes, not a promise that they will remain the newest releases. Prefer the latest supported security release available for your compatible branch.

PHP 8.1 and older: legacy releases, including PHP 8.0, 7.x and 5.x, require urgent vendor assessment. There is no new supported upstream release in these obsolete branches. Migrate to a supported fixed branch, or obtain explicit vendor evidence that both CVEs are patched.

The supported-branch boundaries are corroborated by the Canadian Cyber Centre’s version table. NHS England’s alert also identifies PHP 8.1 and older as affected and end-of-life.

A vendor backport is an important exception to a version-only check. A distribution or managed host can apply fixes while retaining an older base version number. Ask for the full package build and an advisory covering both CVEs. A dashboard that only says “PHP 8.3” cannot establish patch status.

PHP has also made minimal source backports available for 7.4, 8.0 and 8.1. These are an emergency option for appropriately equipped maintainers; they do not restore upstream support or make every old installation patched. See the PHP notice and backport links.

How to prevent attacks: a practical patching sequence

1. Find the PHP runtimes that actually serve traffic

Inventory production sites, APIs, administrative subdomains, staging environments, containers and appliances that bundle PHP. Give publicly reachable services an owner and an immediate remediation decision. The NCSC recommends discovering PHP generally, rather than searching only for obviously old installations.

For WordPress, open Tools → Site Health → Info → Server and confirm details with your host. WordPress’s incident guidance identifies that screen and explains that the required fix is to PHP; there is no WordPress core release specifically fixing these runtime flaws.

On a server you administer, these read-only commands help identify the command-line installation:

command -v php
php -v
php --ini
php -r 'printf("PHP=%s SAPI=%s\n", PHP_VERSION, PHP_SAPI);'

These are inventory checks, not a vulnerability scanner. The PHP CLI manual documents the flags. The output describes the binary you invoked; a website may use a different executable, container image or PHP-FPM pool. PHP’s SAPI documentation explains these distinct execution interfaces. Do not publish a permanent public diagnostic page to collect this information.

2. Install the correct vendor fix

On managed hosting, request confirmation of the patched PHP build for each site. On a self-managed system, use your distribution’s advisory and trusted package channel. For containers, rebuild and redeploy from a fixed image; updating an interactive shell inside one running container leaves the deployment definition unchanged.

Prepare a recoverable backup and check application compatibility before switching PHP branches. The WordPress upgrade guide recommends backing up and checking the site and its extensions. Keep that preparation focused: an exposed vulnerable service should not remain public indefinitely while a migration project is planned.

3. Reload the running service and verify every instance

After installing packages or redeploying images, make sure the workers serving requests have actually been replaced. The required service operation depends on whether the host uses PHP-FPM, Apache, LiteSpeed or another integration; use the host’s documented procedure rather than copying an unrelated restart command.

Verify the web-serving build on every replica, not just the first node behind the load balancer. Record the package or image identifier, deployment time and verification result. A closed change ticket should demonstrate that the fixed runtime is handling traffic.

4. Restrict exposure if patching cannot happen immediately

The NSA recommends taking a system offline if an immediate update is not feasible, until it can be fully mitigated. Temporary isolation is an operational decision to coordinate with the service owner, especially for essential services. Leaving an unverified origin public behind a WAF is not equivalent to completing the patch.

For specialist operators, PHP documents partial configuration mitigations for specific paths. One example is disabling session upload-progress handling in configuration that applies before request parsing, then restarting all workers. PHP 8.5 has an additional fatal-backtrace mitigation. These settings do not close every variant. Application-level ini_set() is too late for the confirmed startup paths, and blindly changing memory limits can create other operational problems. Follow the maintainers’ stale-state mitigation details for your deployment.

How a WAF can block attacks before PHP receives them

A web application firewall evaluates HTTP traffic against configured security rules. An edge or reverse-proxy WAF can reject a matching request before it reaches the origin PHP process:

Visitor → Edge / reverse-proxy WAF → Web server → PHP runtime
                         │
                  Matching request blocked

This placement matters. A firewall implemented solely as a PHP application plugin starts after PHP has already begun processing the request. It cannot be relied on to intercept a mod_php path that executes before application code. That is an architectural consequence of the startup behavior described in the PHP OOM advisory.

For PHP2Shell, look for vendor-managed protections explicitly addressing the two CVEs. Generic SQL injection rules, a CAPTCHA on a login form, or the mere presence of a CDN do not establish coverage. Managed WAF rules have actions, scopes and exceptions that need to be checked.

What security providers have deployed

Cloudflare reported PHP2Shell protections on 21 October, including coverage for Free and paid WAF customers. It also introduced detection combining request and origin-response signals. A matching response rule can prevent a suspicious response from reaching the requester.

Blocking an origin response is not the same as preventing code execution at the origin. The response exists after the origin has processed the request. Treat response filtering as an additional containment signal, not evidence that the vulnerable PHP process was never reached. Cloudflare itself still recommends patching PHP while retaining WAF protection.

Akamai also published PHP2Shell protections, including an Adaptive Security Engine detection for both CVEs. Its guidance likewise prioritizes vendor patches. These provider statements describe their products; they do not prove that any individual site’s configuration is covered.

A WAF deployment checklist

• Check the traffic path. Verify that every relevant hostname is actually routed through the protected service, including APIs and alternate application domains.
• Check the rules and action. Confirm current PHP2Shell protections are enabled and enforced. A rule that only logs a match does not block the request. Review exceptions that could skip inspection.
• Close origin bypasses. A public origin IP or an alternate hostname can let requests avoid the edge. Restrict origin access through the provider-supported mechanism, while preserving required monitoring and administration paths. Cloudflare documents origin-protection options.
• Test normal user journeys. Check login, forms, uploads, checkout and legitimate API integrations. Tune a narrow false positive rather than disabling protection across the entire site.
• Use evidence, not a green icon. Correlate WAF actions with origin logs. Distinguish request blocks from response blocks, and confirm which hostnames and routes the rules cover.

This checklist is an operational verification approach. It is not a universal exploit-blocking rule or a claim that a particular WAF cannot be bypassed.

What to check if the server was already exposed

Patching closes these software flaws, but does not remove persistence or recover stolen secrets. Review the exposure window and preserve relevant logs before routine rotation destroys evidence. The Canadian Cyber Centre recommends examining web, application, authentication and endpoint logs, along with unexpected processes, files, accounts and outbound connections associated with PHP or web services.

OOM messages, worker crashes, restarts and unusual request patterns are useful investigation leads; none alone proves remote code execution. Equally, a quiet application log does not rule out activity before application code began. Escalate unexplained findings through your incident-response process. If compromise is confirmed, containment, trusted recovery and credential rotation belong in the response alongside patching.

Make the next emergency update easier

Keep an inventory connecting each public service to its PHP branch, package source, owner, WAF policy and deployment method. Decide in advance who can approve isolation and who can verify a fixed rollout. The useful record is the running service’s state, not just the package repository’s state.

For the deployment side of that process, use the Atlantix CI/CD deployment guide to build a repeatable release checklist. The container guide explains image, runtime and persistent-data boundaries that are easy to confuse during emergency changes. These are learning resources, separate from the vendor remediation instructions above.

Sources and update notes

This guide is an original Atlantix explanation checked against the sources below on 22 October 2026. Vulnerability reports and WAF rules can change; consult the current advisories before making a production decision.

• PHP security release and mitigation notice.
• PHP advisory: CVE-2026-109618.
• PHP advisory: CVE-2026-109619.
• NSA advisory, 21 October 2026.
• Canadian Cyber Centre version and response guidance.
• NHS England PHP2Shell alert.
• NCSC response priorities.
• WordPress incident guidance.
• Cloudflare PHP2Shell protections.
• Akamai PHP2Shell protections.
• Guardian coverage, 22 October.