# PHP2Shell: a practical patch and check guide for PHP servers

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to fix two critical flaws that it says "can allow unauthenticated remote code execution" ([PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). The day before, PHP had given [advance notice](https://www.php.net/archive/2026.php#2026-10-20-1) that both were rated CVSS v4.0 9.2. If you upgrade, also rotate any secrets a compromised host could have read; the [Railway breach the same week](https://yadui.dev/blog/railway-emudhra-sbi-breaches-explained) shows why.

Two days later, on October 23, PHP published a short [informational advisory](https://www.php.net/archive/2026.php#2026-10-23-1) about a separate issue, CVE-2026-115560. It is not fixed by the October 21 releases. PHP calls it "an unlikely RCE vector" and is handling it in the regular release cycle rather than with another emergency release.

## What the full guide covers

- What happened
- Who is exposed
- What attackers are doing
- The checklist
- What comes next

**Read the complete guide, with commands and sources, on my site: [PHP2Shell: a practical patch and check guide for PHP servers](https://yadui.dev/blog/php2shell-cve-2026-109618-109619-patch-guide)**

*Written by Abhinav Yadav, Cloud & AI Engineer. More at [yadui.dev](https://yadui.dev).*