PHP Critical Security Update: Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35

On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated attacker run code on a web server. Both are rated 9.2 on CVSS v4.0. The PHP project says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that updating is the only complete fix. If you run PHP on a server, update today: security researchers, who call the pair "PHP2Shell", have reported exploitation attempts in the wild since the patches came out, and some activity dates back to before the fix was public.

This guide covers which versions are fixed, how to check what your server runs, what to do on older versions, and the temporary workaround PHP describes for servers you cannot update right away.

What PHP released

The PHP security team gave advance notice on October 20 that a security release would follow on Wednesday, October 21, at 14:00 UTC. It shipped as scheduled, with one release for each supported branch:

PHP describes the two bugs as follows: CVE-2026-109618 comes from out-of-memory handling that leaves request data partly initialized, which cleanup code can then treat as valid, and CVE-2026-109619 comes from stale global state. PHP considers the risk highest for Apache with mod_php, where it says a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. That is why the attack does not depend on what your application does.

Is PHP2Shell being exploited?

As of October 22, 2026, several security firms report attacks against these flaws, though reports differ on how far they have gotten:

• watchTowr says its honeypot network observed exploitation in the wild on October 21, the day of the release, and lists both CVEs as exploited "in the wild" in its PHP2Shell FAQ. It also says older unsupported branches, including PHP 5, are affected.
• Datadog Security Labs reports multiple reports of active exploitation and broad untargeted scanning, and cites AWS reporting exploitation attempts as early as October 17, four days before the patches.
• Rapid7 says in its analysis that it had not itself seen exploitation, while noting multiple reports of attempts. Government alerts on October 21, such as the Canadian Centre for Cyber Security's, said a proof of concept was public but no active exploitation had been identified at that point.

What this means in practice: patch now, and if a server faced the internet unpatched, check its logs and files for anything unexpected from October 17 onward, not just from the release date. Look for new or changed PHP files in web directories, unfamiliar processes started by the web server user, and unexpected outbound connections. If you find signs of compromise, rebuild the server from a clean image rather than cleaning it in place, and rotate any passwords and keys it held.

Who needs to update

Anyone who runs PHP behind a web server, which includes:

• WordPress, Drupal, Joomla, Magento and other PHP CMS sites on a VPS or dedicated server
• Laravel, Symfony and other PHP framework apps
• Docker images built on the official php images
• Shared hosting accounts, where the host controls the PHP build

PHP used only from the command line, for scripts and cron jobs that never handle web requests, is outside the scenario PHP describes, but you should still update it with the rest of the system.

If you use managed or shared hosting, the host has to install the update. Check its status page or ask support whether it has deployed 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or its own backported fix.

How to check which PHP version you run

1. On the server: run php -v for the command-line version. For the version that actually serves web traffic, check the PHP-FPM or Apache package version, for example php-fpm -v or your package manager (apt list --installed | grep php or dnf list installed | grep php). The command-line and web versions can differ.
2. From the outside: enter your site in the HTTP Headers Checker and look for an X-Powered-By: PHP/… header. Many servers hide it with expose_php = Off, so a missing header does not mean you are safe.
3. In WordPress: go to Tools > Site Health > Info > Server, which lists the PHP version.

A version number alone does not tell the whole story on Linux distributions. Debian, Ubuntu, Red Hat and others often backport security fixes into older-looking version numbers, so check your distribution's security tracker for these two CVEs rather than comparing numbers.

How to update

• Package-managed servers (apt, dnf, yum): install the distribution's security update for PHP, then restart PHP-FPM or Apache. A restart is needed: running workers keep the old code in memory.
• Docker: pull the updated official php image tag, rebuild your images and redeploy. Rebuilding on top of a cached old base layer does not help.
• Built from source: download the new release from php.net/downloads, and check the tarball against the SHA-256 checksum php.net publishes. The File Hash tool computes SHA-256 in your browser without uploading the file. Then rebuild and restart.
• Shared hosting: confirm with your host, or switch the PHP version in your control panel to a patched branch if it offers one.

After updating, restart every worker and confirm the new version from the web side, not just the command line.

PHP 8.1 and older

PHP 8.1 and earlier no longer receive releases from the PHP project, and they are affected. PHP's advisory says some Linux distributions and long-term-support vendors provide backported fixes, and it points to minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP themselves. If you are still on one of these versions, ask your distribution or vendor for a patched package, and plan a move to a supported branch: this release shows why running an unsupported PHP is risky.

Temporary workaround if you cannot update today

PHP's advisory lists interim measures, with a clear warning that there is no complete mitigation and updating is the only safe choice:

• Set session.upload_progress.enabled = 0 in php.ini (or in server configuration that applies before PHP parses the request), then restart every PHP worker. PHP says this blocks the confirmed attack paths through sessions but not other variants.
• On PHP 8.5, PHP also suggests setting fatal_error_backtraces = 0.

Treat these as a stopgap for hours, not a fix, and update as soon as you can. A web application firewall rule from your hosting or CDN provider can add another layer, but it does not replace the update either.

Why a request-parsing bug is so serious

Most web vulnerabilities live in application code: a plugin that forgets to check a permission, or a form that trusts its input. These two are different. They sit in PHP itself, in code that handles requests before your application sees them. That means a fully up-to-date WordPress install with no plugins can still be exposed, and an attacker needs no account or special page to reach the bug.

The same pattern appeared this week in the eMudhra certificate authority incident: when a flaw sits in shared infrastructure rather than one app, the fix has to come from everyone who runs it, and the safest response is to patch quickly and then confirm the patch took effect.

Common questions

Is my WordPress site affected? If it runs on PHP and serves web requests, yes, until the server's PHP is updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-patched build. Updating WordPress itself does not fix it, because the bug is in PHP, not WordPress.

Do I need to restart after updating? Yes. Restart PHP-FPM, Apache or whichever process serves PHP, because running workers keep using the old code until they restart.

I'm on shared hosting. What should I do? Ask your host whether the PHP update or a backported fix is deployed, and switch your account to a patched PHP version if the control panel lets you.

What about PHP 7.4 or 8.0? The PHP project no longer releases them. Get a patched package from your distribution or LTS vendor if one exists, and move to a supported branch as soon as you can.

Is PHP2Shell being exploited? Several security firms report exploitation attempts since October 21, and Datadog cites AWS seeing attempts as early as October 17. Patch now, and review unpatched internet-facing servers for signs of compromise from October 17 onward.

Is turning off session upload progress enough? No. PHP says it only blocks the confirmed session paths and that updating is the only complete fix.