How to Fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Two critical vulnerabilities in PHP, two potential remote shells, and one very simple solution: update your PHP runtime.

TL;DR: Fix PHP2Shell Now

PHP released emergency security updates on October 21, 2026. Upgrade to one of these versions or a newer patched release:

PHP branch	Fixed version
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

For Docker users, update your base image. For example, if you're using PHP 8.4 with FPM:

FROM php:8.4.27-fpm

Once the patched image is available, rebuild and redeploy your application. For Docker Compose:

docker compose build --pull --no-cache docker compose up -d --force-recreate

Don't stop at rebuilding. Verify that the deployed containers actually run the patched PHP version.

If your Linux vendor backports security patches, the package version may differ. Check the vendor's security advisory.

Docker Hardened Images

Docker Hardened Images publishes PHP as well, but the fix is not there yet either. The current Debian-based runtime dhi.io/php:8.5-fpm runs PHP 8.5.11 — the same pre-patch level as the official image — and no patched tag (8.5.12-fpm, 8.4.27-fpm, and so on) has been published in either registry. DHI scans clean (no critical or high CVEs) thanks to its minimal base and VEX data, but that does not mean it carries this fix.

FROM dhi.io/php:8.5-fpm

So treat Docker Hardened Images as another place to wait for the patched version, not a shortcut around patching. And resist the urge to build your own PHP image from patched sources in the meantime: hand-rolled images drift from vendor-supported builds and leave you maintaining security patches yourself. Use a -fpm variant at runtime and a -dev variant only for build stages.

Let Your AI Agent Fix It 🤖

If you're using an AI coding agent, give it this prompt:

Check this repository for PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

Identify PHP versions in Dockerfiles, container images, CI/CD configurations, and deployment manifests.

Upgrade affected runtimes to patched releases (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later), accounting for vendor backports.

Update image references and rebuild instructions. Don't upgrade to a different major or minor PHP branch unless necessary.

Run available tests and vulnerability scans.

Show me the changes, remaining risks, and how to verify the running production version.

Don't deploy without my approval. Don't claim the vulnerability is fixed without verifying the runtime or its vendor patch status.

And please, sandbox your coding agent. You don't need another security incident while fixing this one. 😅

What Is PHP2Shell?

PHP2Shell is the name given to two critical remote code execution (RCE) vulnerabilities in PHP itself.

CVE-2026-109618: Out-of-memory handling can leave internal request data partially initialized, leading to memory corruption during cleanup.
CVE-2026-109619: Request-specific global state can outlive its allocated memory, creating a use-after-free vulnerability in subsequent requests.

Both have a CVSS v4.0 score of 9.2.

The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache mod_php, and other PHP server integrations.

The especially nasty part? PHP reports a demonstrated attack against mod_php that can trigger before your application code even runs.

This is not a WordPress plugin vulnerability. It's not something you can fix with a Composer update. The problem is in the PHP runtime.

How to Check Your Docker Images

First, identify the PHP version in your container:

docker run --rm --entrypoint php my-php-app:latest -v

Vulnerability databases can lag behind new advisories, so confirm the runtime version from the image's package inventory before trusting a CVE scan:

docker scout sbom my-php-app:latest --format list | grep -i php

Then scan the image for the two vulnerabilities using Docker Scout:

docker scout cves \ --only-cve-id CVE-2026-109618,CVE-2026-109619 \ my-php-app:latest

You can also scan with Trivy:

trivy image --scanners vuln my-php-app:latest

Remember that vulnerability databases may take time to incorporate new advisories. No CVE findings doesn't necessarily mean your image is safe. Verify the PHP runtime version and vendor patch status.

Also verify your running containers. An updated image sitting in your registry doesn't protect a container that's still running yesterday's code.

What If You Can't Update Immediately?

There are temporary measures, but none is a complete fix.

PHP recommends disabling session.upload_progress.enabled to block some confirmed attack paths, restarting all workers afterward. Other mitigations include restricting request sizes and addressing specific memory-handling conditions.

However, PHP explicitly warns that configuration mitigations cannot eliminate every exploitation path.

A non-root container, restricted network access, dropped capabilities, and a read-only filesystem can reduce the damage after compromise. They cannot fix memory corruption inside PHP.