PHP Critical Vulnerability php2shell: What to Do Now

According to PHP's announcement of 21 October 2026, versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can allow remote code execution without authentication. Both scored 9.2 on the CVSS v4.0 scale, a standard rating of severity. Remote code execution means an attacker can run commands on the server with the privileges of the web worker account.

Every PHP installation serving web requests is affected: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Amazon Threat Intelligence wrote on 21 October that its honeypot network saw the first exploitation attempt on 17 October, four days before disclosure. SecurityWeek reports that watchTowr says the proofs of concept now circulating have not yet reached code execution. Attempts exist, proof of success is limited, and that is no reason to wait.

If your site runs on PHP, assume it is affected. According to Anadolu Agency, the FBI estimates PHP is used on about 70% of websites, and CISA notes it can be embedded inside other software where you cannot see it. Our technology detection tool gives a first outside impression of what your site runs on, but do not expect it to confirm the version.

For the version itself, follow WordPress.org: in the WordPress admin open Tools, Site Health, Info, Server. Hosting panels usually show it too, and for other sites your developer or provider must tell you. If it is below the number for your line (8.2.35, 8.3.36, 8.4.27 or 8.5.12), the GitHub advisories say you are affected.

On shared hosting the provider manages the server, so ask in writing: has PHP been updated for these flaws, and which version am I on? WordPress.org says hosts changed position hour by hour: some patched, some said a WAF (a firewall that filters requests) protected them, some were still working. If the answer is that you are protected, ask which version you were moved to.

According to cPanel's release notes, EasyApache 4 25.91 fixes both flaws from ea-php74 up to ea-php85. Such packages usually arrive automatically, but that is our reading, so the administrator should verify versions in WHM. With Plesk, ask your provider for the package and version. On your own server, the Laravel Forge knowledge base says automatic security updates do not patch PHP; update it separately on every server.

PHP 8.1 and earlier no longer receive updates from the PHP project. Its security team provided minimal source backports for 7.4, 8.0 and 8.1 and some distributions backport too, but these may not have reached your host. According to VulnCheck, more than 2.6 million internet-facing PHP servers were counted, at least 1 million of them on versions past end of life.

CISA recommends taking systems offline if they cannot be updated or run 8.1 or earlier. If your site earns nothing, such as a brochure page, that is a realistic option. PHP 8.2 reaches end of life on 31 December 2026, so moving to 8.2.35 buys only a short time; plan your version path now.

PHP's announcement is clear: only updating is a complete fix, and temporary measures reduce exposure to specific attack paths but do not make an installation safe. The GitHub advisory for the second flaw adds that more workers and worker recycling lower the success rate without removing the risk. CISA suggests a WAF as a temporary step, and the word temporary matters.

These are the measures PHP lists, and your server administrator, not you, should apply them. According to Codeable, WordPress does not use session.upload_progress, but ask about other applications on the server.

• memory_limit=-1, set so the application cannot override it (via php_admin_value)
• A low post_max_size: 8M if you have no file uploads, 32M if you do, with upload_max_filesize below it
• session.upload_progress.enabled=0 and a restart of all workers, set in php.ini or the pool configuration, not via ini_set or .user.ini
• fatal_error_backtraces=0 on PHP 8.5
• Do not use RLIMIT_AS or RLIMIT_DATA, because they can trigger the flaw

Amazon says investigation should start from at least 17 October. Its indicators are POST requests to form uploads containing the PHP_SESSION_UPLOAD_PROGRESS string, suspicious web server log entries, and unexpected process activity or file changes. Ask your provider to search for them. Our security audit tool checks the basic settings visible from outside; it does not replace server logs and files.

Then long-running processes. According to Laravel Forge, an update restarts PHP-FPM, but queue workers, Horizon and Octane started from the command line keep running the old PHP until restarted. Verify with php8.4 -v and php-fpm8.4 -v if you use 8.4; Qualys notes php -v can differ from the installation serving web requests. If you set memory_limit=-1 as a stopgap, restore a finite value. If you find traces or cannot be sure, discuss changing database passwords, API keys and admin passwords with your administrator; that is a general hygiene principle, not something the sources state.

Three mistakes stand out, and avoiding them matters as much as the update itself.

Amazon writes that a 7 or 30 day patch window assumes a delay that no longer exists; measure in hours. The lesson is plain: write down who owns the software under your site, who updates it and whom to call, and tie end-of-life versions to a calendar.

• Thinking a plugin, theme or WordPress update is enough: WordPress.org says no WordPress update is needed or planned, and updating a plugin or theme does not protect you
• Trusting php -v: the command line version can differ from the installation that serves web requests
• Treating a WAF as the solution: CISA lists it as temporary, and a host saying it uses one does not show the version is current