[{"data":1,"prerenderedAt":215},["ShallowReactive",2],{"seo-verification":3,"blog-php2shell-cve-2026-109618-109619-patch-php-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-php2shell-cve-2026-109618-109619-patch-php-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":153,"ctaBody":154,"ctaButton":155,"ctaUrl":156,"relatedPosts":157},489,"php2shell-cve-2026-109618-109619-patch-php",{"fr":12,"en":10,"ar":13,"es":14},"php2shell-cve-2026-109618-109619-mettre-a-jour-php","php2shell-cve-2026-109618-109619-تحديث-php","php2shell-cve-2026-109618-109619-actualizar-php","PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619","PHP2Shell: two critical PHP flaws exploitable without an account. Patched versions, update commands per system and temporary mitigations.",9,0,false,"2026-10-22T00:00:00+00:00","2026-10-22T01:57:44+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fphp2shell-cve-2026-109618-109619-mettre-a-jour-php-poster.svg","On 21 October 2026, the PHP security team issued emergency releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two flaws nicknamed “PHP2Shell”: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 under CVSS 4.0. They target the interpreter itself, not an application: a single anonymous HTTP request is enough, before your code even starts to run. Exploitation attempts have been observed since the very day of publication. Here is what these two flaws do, how to find out whether your servers are exposed, and how to fix them on Debian, Ubuntu, RHEL, cPanel and Docker.",[35,39,49,52,82,85,101,104,122,125,129,132,147,150],{"type":36,"title":37,"body":38},"h2","PHP2Shell at a glance","PHP2Shell is not a flaw in WordPress, Laravel or a plugin: the PHP engine itself is at fault. Every PHP application that answers web requests is therefore affected, whatever its code looks like. The security advisory names PHP-FPM, Apache with `mod_php`, `php-cgi`, FrankenPHP and LiteSpeed.\n\nBoth flaws share the same underlying mechanism. When PHP abruptly aborts a request (exhausted memory, fatal error), it can leave behind an internal state that is only half initialised or that has already been freed. A subsequent request, handled by the same PHP process, then reuses that state: this is what opens the door to remote code execution.",{"type":40,"title":41,"items":42},"ul","Key takeaways",[43,44,45,46,47,48],"**CVE-2026-109618** — memory corruption when `memory_limit` is exceeded: request data that was only partially initialised is later treated as valid during the cleanup phase.","**CVE-2026-109619** — stale global state: state that belongs to one request survives after its memory has been freed and can be read by the next request on the same process.","**Score**: 9.2 out of 10 under CVSS 4.0 for each one, with no authentication and no user interaction required.","**Patched versions**: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project no longer publishes releases for 8.1 and the older branches.","**Exploitation**: watchTowr reports exploitation attempts caught in its network honeypots as early as 21 October 2026.","**Scope**: researchers believe the affected branches go all the way back to PHP 5.4, although not every single version has been tested individually.",{"type":36,"title":50,"body":51},"Why these two flaws are so dangerous","Most web flaws require a specific form, a user account or a vulnerable plugin. PHP2Shell needs none of that: the most common trigger is the processing of a `multipart\u002Fform-data` upload with session upload progress tracking (`session.upload_progress`), a mechanism that PHP enables by default and that runs **before** the first byte of your application. A web application firewall living inside your code, a WordPress security plugin or a Laravel middleware therefore all come into play too late.\n\nThe second factor is the execution model itself. PHP-FPM and Apache reuse the same process for hundreds of successive requests: this is precisely what allows a booby-trapped request to contaminate the next one. According to Imperva, the published techniques range from crashing processes to reading arbitrary files through the OPcache cache, including leaking around 67 KB of process memory inside an oversized `PHPSESSID` cookie. That memory can contain database passwords or API keys.",{"type":53,"title":54,"headers":55,"rows":59},"comparison","Which version to install for your branch",[56,57,58],"PHP branch","Patched version","What to do",[60,64,67,70,74,78],[61,62,63],"8.5","8.5.12","Update, then restart PHP",[65,66,63],"8.4","8.4.27",[68,69,63],"8.3","8.3.36",[71,72,73],"8.2","8.2.35","Update, then plan the migration to 8.3 or 8.4",[75,76,77],"8.1, 8.0, 7.4","No official release","Your distribution's patched package, a source backport, or else migration",[79,80,81],"7.3 and earlier, 5.x","No published fix","Migrate to a maintained branch",{"type":36,"title":83,"body":84},"Check whether your servers are exposed","Watch out for a classic trap: the version shown by `php -v` on the command line is not necessarily the one that serves your websites. A server can have several versions of PHP-FPM installed side by side, and each site can point to a different one. You therefore need to check the version that is actually served over the web, one site at a time.",{"type":86,"title":87,"steps":88},"steps","Take an inventory of the PHP versions being served",[89,92,95,98],{"title":90,"body":91},"List the installed versions","On Debian or Ubuntu:\n\n```bash\ndpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\\n' 'php*' | awk '$1==\"ii\"' | grep -E 'php[0-9.]+-(fpm|cli|common)|libapache2-mod-php'\n```\n\nOn RHEL, AlmaLinux or Rocky Linux:\n\n```bash\nrpm -qa 'php*' 'ea-php*' 'alt-php*' | sort\n```",{"title":93,"body":94},"Find the PHP processes that are running","```bash\nsystemctl list-units --type=service --state=running | grep -E 'php|apache2|httpd|lsws'\n```\n\nEvery active `phpX.Y-fpm` service is a version you need to check and to patch.",{"title":96,"body":97},"Read the version served by a site","Drop a temporary file at the root of the site, query it, then **delete it immediately** afterwards:\n\n```bash\necho '\u003C?php echo PHP_VERSION, \" \", PHP_SAPI;' > \u002Fvar\u002Fwww\u002Fmonsite\u002Fv-check.php\ncurl -s https:\u002F\u002Fmonsite.example\u002Fv-check.php\nrm \u002Fvar\u002Fwww\u002Fmonsite\u002Fv-check.php\n```\n\nA result such as `8.3.36 fpm-fcgi` indicates a patched version being served by PHP-FPM.",{"title":99,"body":100},"Check your Docker containers","```bash\ndocker ps --format '{{.Names}}' | while read c; do echo \"$c: $(docker exec \"$c\" php -r 'echo PHP_VERSION;' 2>\u002Fdev\u002Fnull)\"; done\n```\n\nA container without PHP shows nothing at all after its name.",{"type":36,"title":102,"body":103},"Apply the fix","Linux distributions and extended support vendors received the fixes ahead of the public release. The patched package from your distribution therefore does not necessarily carry the number 8.3.36: Ubuntu 24.04, for example, patches its own version 8.3.6 in the package `8.3.6-0ubuntu0.24.04.13`. Rely on your distribution's security advisory rather than on the PHP version number alone. In every case, **a restart is essential**: as long as the old processes keep running, it is the old code that answers your requests.",{"type":86,"title":105,"steps":106},"Update PHP for your environment",[107,110,113,116,119],{"title":108,"body":109},"Debian and Ubuntu","```bash\nsudo apt update\nsudo apt install --only-upgrade $(dpkg-query -W -f='${db:Status-Abbrev} ${Package}\\n' 'php*' | awk '$1==\"ii\"{print $2}')\nsudo systemctl restart 'php*-fpm'\nsudo systemctl restart apache2   # if you use mod_php\n```\n\nIf your versions come from a third-party repository (for example the `ondrej\u002Fphp` PPA), check that the version installed after the update really is one of the patched versions.",{"title":111,"body":112},"RHEL, AlmaLinux, Rocky Linux","```bash\nsudo dnf upgrade 'php*'\nsudo systemctl restart php-fpm\nsudo systemctl restart httpd\n```\n\nAlmaLinux published its patched packages on 21 October 2026. The community Remi repository, on the other hand, had no update available at the time of the announcement: if you depend on it, check the installed version afterwards.",{"title":114,"body":115},"cPanel server (EasyApache 4 or CloudLinux)","```bash\nsudo dnf upgrade 'ea-php*' 'alt-php*'\n\u002Fscripts\u002Frestartsrv_apache_php_fpm\n\u002Fscripts\u002Frestartsrv_httpd\n```\n\nOn an older server, replace `dnf` with `yum`. Then check each version in **WHM › MultiPHP Manager**: any account still set to a branch with no fix available (7.x, 8.0, 8.1) must be switched over to a maintained version.",{"title":117,"body":118},"Docker containers","```bash\ndocker compose pull\ndocker compose up -d --force-recreate\ndocker compose exec app php -r 'echo PHP_VERSION;'\n```\n\nIf your `Dockerfile` starts from a `php:8.3-fpm` image, rebuild the image with `docker compose build --pull`: without `--pull`, Docker reuses the old base image that it has in its cache.",{"title":120,"body":121},"Check the result","Run the check from the previous step again on every site. The fix is only in place if the version **served over the web** is patched, not merely the version installed on disk.",{"type":36,"title":123,"body":124},"If you cannot update right away","The official PHP advisory suggests settings that **reduce** exposure without making the installation safe. They are there to buy you a few hours, not to replace the fix. They must be set in `php.ini`, in the PHP-FPM pool or in the web server configuration, never through `ini_set()` or a `.user.ini` file: those are read too late, after the request has already been parsed.\n\nAgainst CVE-2026-109619, disable upload progress tracking. On PHP 8.5, also disable fatal error backtraces:\n\n```ini\n; in the FPM pool, for example \u002Fetc\u002Fphp\u002F8.3\u002Ffpm\u002Fpool.d\u002Fwww.conf\nphp_admin_flag[session.upload_progress.enabled] = off\n; PHP 8.5 only:\nphp_admin_flag[fatal_error_backtraces] = off\n```\n\nAgainst CVE-2026-109618, the advisory recommends `memory_limit = -1` enforced through `php_admin_value`, so that no application can redefine it, together with a bounded request size (`post_max_size = 8M`, or 32M if you need file uploads). In return, memory has to be capped somewhere else, with a container or cgroup limit. Do not use `RLIMIT_AS` or `RLIMIT_DATA`: they are exactly what causes the vulnerable allocation failure.\n\nThen restart **all** PHP processes so that the settings take effect.",{"type":126,"title":127,"body":128},"tip","Add a barrier in front of PHP","Cap the size of requests at the web server level, before they ever reach PHP: `client_max_body_size 8m;` in nginx, `LimitRequestBody 8388608` in Apache. If your site sits behind Cloudflare in proxied mode, WAF rules targeting the known PHP2Shell vectors have been rolled out to every account, the free plan included. These are safety nets only: nothing but the PHP update actually closes the flaw.",{"type":36,"title":130,"body":131},"Look for traces of exploitation","The published attempts leave characteristic traces behind: PHP processes that crash, bursts of out-of-memory errors and `multipart` uploads that are abnormally large. If your server was exposed before you updated it, take ten minutes to check.",{"type":86,"title":133,"steps":134},"Checks to run after applying the fix",[135,138,141,144],{"title":136,"body":137},"Look for killed PHP-FPM processes","```bash\nsudo grep -E 'exited on signal (11|6)' \u002Fvar\u002Flog\u002Fphp*-fpm.log | tail -20\n```\n\nA series of processes killed by signal 11 (SIGSEGV) since 21 October is a warning sign.",{"title":139,"body":140},"Look for memory limit overruns","```bash\nsudo grep -rh 'Allowed memory size' \u002Fvar\u002Flog\u002Fphp* \u002Fvar\u002Flog\u002Fnginx \u002Fvar\u002Flog\u002Fapache2 2>\u002Fdev\u002Fnull | tail -20\n```",{"title":142,"body":143},"Spot recently created PHP files","```bash\nsudo find \u002Fvar\u002Fwww \u002Fhome -name '*.php' -newermt '2026-10-20' -not -path '*\u002Fvendor\u002F*' -not -path '*\u002Fcache\u002F*' -ls\n```\n\nAn unknown file with a generic name, in an upload folder or in `\u002Ftmp`, should be examined before you delete anything.",{"title":145,"body":146},"When in doubt, treat the server as compromised","Isolate the machine, keep a copy of the logs, then rotate the database passwords, the API keys and the secrets stored in `.env` files: a memory leak may have exposed them without leaving any other trace behind.",{"type":36,"title":148,"body":149},"On shared hosting","On shared hosting, you are not the one who updates PHP: the hosting provider maintains the versions on offer. Your part of the job is to check that your site uses a branch that still receives fixes. In cPanel, the version selection tool (**MultiPHP Manager**, or **Select PHP Version** on a CloudLinux server) shows the active version for each domain. If your site still runs on 7.4, 8.0 or 8.1, those branches no longer receive official PHP releases: switch to 8.3 or 8.4 after testing your site, following \u003Ca href=\"\u002Fen\u002Fblog\u002Fphp-82-end-of-life-planning-your-migration\">our PHP migration checklist\u003C\u002Fa>.",{"type":36,"title":151,"body":152},"The official documentation","The technical details and the workaround settings are published in \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php\">the PHP security advisory\u003C\u002Fa> and in the GitHub advisories \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-w8hw-w9fx-j79w\">GHSA-w8hw-w9fx-j79w\u003C\u002Fa> (CVE-2026-109618) and \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp\">GHSA-6wmf-4rv5-p3rp\u003C\u002Fa> (CVE-2026-109619). For distribution packages, see \u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fblog\u002Fphp2shell-vulnerability-fixes-available\">the Ubuntu announcement\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Falmalinux.org\u002Fblog\u002F2026-10-21-php2shell-cve-2026-109618-cve-2026-109619\u002F\">the AlmaLinux one\u003C\u002Fa>.","Stay in control of your PHP versions","On a ServOrbit.com VPS, you have root access: you apply a PHP fix as soon as it is published, you choose the version used by each site and you restart your services whenever you decide to.","Explore our VPS plans","\u002Fvps-cloud",[158,175,197],{"id":159,"slug":160,"slugs":161,"title":165,"excerpt":166,"readTime":167,"views":168,"isPinned":19,"publishedAt":169,"updatedAt":170,"category":171,"categories":172,"featuredImage":30,"bgImage":31,"posterImage":174,"relatedSolution":30},382,"vps-automatic-security-updates-debian-ubuntu",{"fr":162,"en":160,"ar":163,"es":164},"securite-vps-mises-a-jour-automatiques-debian-ubuntu","تحديثات-أمان-تلقائية-vps-debian-ubuntu","actualizaciones-seguridad-vps-debian-ubuntu","Automatic Security Updates on Debian\u002FUbuntu VPS","Configure unattended-upgrades on your Debian\u002FUbuntu VPS to automate security patches and reduce attack surface across your client fleet.",10,2,"2026-09-26T00:00:00+00:00","2026-09-29T14:40:42+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[173],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsecurite-vps-mises-a-jour-automatiques-debian-ubuntu-poster.svg",{"id":176,"slug":177,"slugs":178,"title":182,"excerpt":183,"readTime":184,"views":185,"isPinned":19,"publishedAt":186,"updatedAt":187,"category":188,"categories":194,"featuredImage":30,"bgImage":31,"posterImage":196,"relatedSolution":30},206,"php-82-end-of-life-planning-your-migration",{"fr":179,"en":177,"ar":180,"es":181},"php-82-fin-de-vie-checklist-migration","نهاية-دعم-php-82-دليل-الترحيل","php-82-fin-de-vida-planificar-la-migracion","PHP 8.2 end of life: your migration checklist","PHP 8.2 reaches EOL on December 31, 2026. Inventory your stack, compare PHP versions, and follow a step-by-step migration checklist to PHP 8.3 or 8.4.",11,5,"2026-08-01T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":189,"name":190,"slug":191,"color":192,"icon":193},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[195],{"id":189,"name":190,"slug":191,"color":192,"icon":193},"\u002Fblog\u002Fcovers\u002Fphp-82-fin-de-vie-checklist-migration-poster.svg",{"id":198,"slug":199,"slugs":200,"title":204,"excerpt":205,"readTime":23,"views":18,"isPinned":19,"publishedAt":206,"updatedAt":207,"category":208,"categories":209,"featuredImage":30,"bgImage":31,"posterImage":211,"relatedSolution":212},373,"wordpress-cve-2026-87902-update-to-712-now",{"fr":201,"en":199,"ar":202,"es":203},"wordpress-cve-2026-87902-rce-mise-a-jour-7-1-2","ووردبريس-cve-2026-87902-ترقية-7-1-2","wordpress-cve-2026-87902-actualiza-a-712-urgente","WordPress CVE-2026-87902: Update to 7.1.2 Now","CVE-2026-87902 (CVSS 9.2) actively exploited since Sept. 22, 2026. Check your version, apply WordPress 7.1.2, and see why shared hosting extends exposure.","2026-09-24T00:00:00+00:00","2026-09-24T12:27:51+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[210],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fwordpress-cve-2026-87902-rce-mise-a-jour-7-1-2-poster.svg",{"categorySlug":213,"appSlug":214},"cms-websites","wordpress",1792634728139]