PHP2Shell: a practical patch and check guide for PHP servers

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to fix two critical flaws that it says "can allow unauthenticated remote code execution" (PHP security advisory). The day before, PHP had given advance notice that both were rated CVSS v4.0 9.2. If you upgrade, also rotate any secrets a compromised host could have read; the Railway breach the same week shows why.

Two days later, on October 23, PHP published a short informational advisory about a separate issue, CVE-2026-115560. It is not fixed by the October 21 releases. PHP calls it "an unlikely RCE vector" and is handling it in the regular release cycle rather than with another emergency release.

What the full guide covers

• What happened
• Who is exposed
• What attackers are doing
• The checklist
• What comes next

Read the complete guide, with commands and sources, on my site: PHP2Shell: a practical patch and check guide for PHP servers

Written by Abhinav Yadav, Cloud & AI Engineer. More at yadui.dev.