php2shell: how to patch PHP
PHP fixes two critical vulnerabilities on 21 October 2026. How to patch PHP on shared hosting, your own server and Docker, and cut the risk until then.
- You need
- Hosting panel
- Updated
php2shell is two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which PHP fixes in a security release on 21 October 2026 at 14:00 UTC. The bug is in PHP on the server, so updating WordPress or your plugins won't help. The hole only closes once the server runs the patched PHP version and PHP has been restarted. For the background and what has been confirmed, see our article on php2shell.
Check which PHP version you have
Go to Tools → Site Health, open the Info tab and expand Server. The PHP version is listed there.
| PHP version | Gets a php2shell fix | What to do |
|---|---|---|
| 8.2, 8.3, 8.4 and 8.5 | Yes | Update to the releases PHP ships at 14:00 UTC |
| 8.1 and older | No | Move to PHP 8.3 or newer |
The last releases before the fix are 8.2.34, 8.3.35, 8.4.26 and 8.5.11. If Site Health shows one of those, PHP hasn't been patched. The exception is Ubuntu and Debian, which often patch their own PHP packages without changing the version number. On those systems, check the package changelog instead.
Patch PHP
On shared hosting, your hosting provider installs PHP updates for every customer. You can't do it yourself.
- Look for a status page or news post from your hosting provider about php2shell.
- If there's nothing, ask support to confirm which PHP version your site runs and when the fix was installed.
- If the site runs PHP 8.1 or older, switch version in the hosting control panel. Our article on upgrading PHP explains how to do it without taking the site down.
Not sure who your hosting provider is? Here's how to find out who hosts your website.
Reduce the risk until PHP is patched
According to the leaks, at least one of the two routes in goes through the session.upload_progress setting. WordPress doesn't use it and very few plugins do, so you can turn it off without breaking anything. It's a partial mitigation and doesn't replace the patch.
You can't change this setting with ini_set() from your code. Where it goes depends on how PHP runs:
Create a separate file in the directory for extra settings, for example /etc/php/8.3/fpm/conf.d/99-php2shell.ini on Ubuntu and Debian, containing this line:
session.upload_progress.enabled = 0
Restart PHP afterwards. A file of its own is easy to find and remove later.
Check the setting has taken effect. Create info.php in the root folder containing <?php phpinfo();, open it in your browser and search for session.upload_progress.enabled. The Local Value column should read Off. Delete the file straight away, because it reveals a lot about your server.
If the site runs PHP 8.1 or older
PHP 8.1 and older get no php2shell fix. Move to PHP 8.3 or newer as described in our article on upgrading PHP. If you can't do that right away, restrict the site to known IP addresses until it's upgraded. Your hosting provider or developer can set that up.
Once PHP is patched
The patch closes the hole, but it doesn't remove a backdoor planted before you applied it. Check the server as described in how to look for a compromise after php2shell. You can leave the session.upload_progress line in place, since WordPress doesn't use the feature.