PHP2Shell Fix Guide: Patched Versions, Emergency Mitigations, and Verification

Key Takeaways

• PHP2Shell patches are available. PHP released security updates on October 21, 2026, addressing CVE-2026-109618 and CVE-2026-109619.
• Update the PHP runtime serving your website. Updating a CMS, plugin, or command-line PHP installation alone may leave the web application exposed.
• Disabling session upload progress provides partial mitigation. It does not repair every vulnerable execution path.
• Verify the running deployment after patching. Check each site's actual runtime and ensure old workers have been replaced.
• Cloudflare WAF protections supplement the patch. A PHP origin still needs updating.

Updated October 22, 2026. For an installation already on a supported PHP branch, the practical priority is a security update within that branch, followed by worker replacement and verification. Treat broader application migrations as a separate task unless the existing branch cannot receive a trustworthy fix.

What Is PHP2Shell?

PHP2Shell is the name associated with a group of PHP memory-safety vulnerabilities and the researchers' exploit demonstrations. The disclosed issues are tracked under two CVEs and affect the interpreter beneath applications built with PHP.

Calif's original research traces the earliest affected path it identified to PHP 5.4.0. Exploitation paths vary with the PHP version, server interface, configuration, and application behavior; a demonstration against one deployment should not be treated as an identical recipe for every installation.

These descriptions follow the PHP project's OOM advisory and stale-state advisory.

Calling PHP2Shell simply a malicious serialized object that invokes a magic method misses the central failure: unsafe interpreter state during error handling and request cleanup. Session decoding is involved in some paths, but ordinary application-level deserialization advice does not address the full issue.

Wiz's research also demonstrates why checking only for a web shell is insufficient: sensitive worker memory can be disclosed without achieving remote code execution.

Which PHP Versions Fix PHP2Shell?

The PHP security announcement identifies these patched releases:

Install the applicable fixed release or a later supported release containing the fixes. Distribution packages may carry backported patches while retaining an older upstream version number; verify the complete package revision against the vendor's advisory.

PHP 8.1 and earlier no longer receive normal upstream security releases. Exceptionally, PHP provided minimal source backports for 7.4, 8.0, and 8.1 for this incident. These are patches for source builds, not renewed support or universally available binary updates. Legacy installations need a vendor-confirmed patched package, a correctly maintained patched build, or migration to a supported branch.

Why Website Code Alone Cannot Fix It

The PHP Foundation reports that an Apache mod_php attack can reach vulnerable processing before application code executes. It also reports PHP-FPM exploitation through application-level paths. PHP-FPM should therefore not be treated as inherently immune.

The operational implication is significant: a login check, framework middleware, or WordPress security plugin may run too late to stop an earlier interpreter failure.

Researchers demonstrated attacks against WordPress, Drupal, Joomla, and other applications. Those applications illustrate exposure; they are not a prerequisite for the vulnerability. Custom PHP applications must also be assessed.

For a Yaf, Laravel, or custom PHP deployment, focus the assessment on the actual interpreter, extensions, and request-processing configuration. A framework version alone does not establish whether the runtime has been patched.

The Fastest Reliable Remediation Workflow

1. Identify every web-facing PHP deployment.

Create a short inventory covering production sites, APIs, staging environments, administrative tools, and container replicas. Record the hostname, runtime branch, package or image revision, service owner, and patch status.

For a portfolio of websites, group the work by PHP runtime and hosting environment. Several domains may share one pool, while a single server may run multiple independent PHP versions.

2. Inspect command-line PHP, then verify the website separately.

Start with these inventory commands:

php -v
php --ini

The PHP CLI documentation defines these as version and configuration-file checks. They describe the executable invoked in that shell, not necessarily the PHP instance handling HTTP requests.

PHP supports different server interfaces and configuration locations. A successful CLI update is therefore insufficient evidence that an FPM pool or Apache module has changed.

3. Install the appropriate patched runtime.

Use the package source or hosting mechanism that owns the deployment. For containers, rebuild or obtain a patched image and replace running containers; changing an image tag in configuration does not establish that existing replicas have been replaced.

For managed hosting, request confirmation of the installed package revision, coverage of both CVEs, and worker replacement. A dashboard displaying only PHP 8.2 or PHP 8.3 is not sufficiently precise.

4. Replace the affected workers.

Plan a controlled restart or rolling replacement of the PHP processes. For FPM, target the relevant FPM service and pools. For Apache mod_php, replace the Apache workers that load PHP.

Restarting a reverse proxy alone does not demonstrate that its separate PHP backend has restarted. Confirm the service relationship before choosing an action.

5. Verify the deployed runtime and essential application flows.

Check each pool or replica, then exercise login, sessions, forms, uploads, and important administrative operations. Record the runtime version or vendor package revision alongside the deployment time.

Keep an application recovery plan, but do not make restoring an exposed, unpatched runtime the default response to a compatibility problem. Route traffic to a patched healthy deployment or temporarily restrict the affected service while resolving it.

How to Verify the PHP Runtime Serving a Website

A temporary diagnostic endpoint can report a limited set of runtime details. Restrict access at the web server or proxy before creating it, bypass caching, and remove it after verification.

<?php
header('Content-Type: application/json');
header('Cache-Control: no-store');

echo json_encode([
    'phpVersion' => PHP_VERSION,
    'sapi' => PHP_SAPI,
    'loadedIni' => php_ini_loaded_file(),
    'uploadProgressEnabled' => filter_var(
        ini_get('session.upload_progress.enabled'),
        FILTER_VALIDATE_BOOLEAN
    ),
], JSON_PRETTY_PRINT);

PHP_SAPI identifies the runtime interface, such as fpm-fcgi or apache2handler. php_ini_loaded_file() identifies the primary configuration file, although additional configuration files and overrides may also apply.

Use the output as deployment evidence, with two qualifications:

• Backported fixes require package-level verification. The displayed PHP version alone may not reveal the vendor's security changes.
• A request-time setting does not prove that it applied early enough. In particular, PHP warns against relying on FPM .user.ini or application ini_set() for the upload-progress mitigation. Configure it before request parsing.

Temporary PHP2Shell Mitigations and Their Limits

Temporary controls are useful while arranging the update, but they should have an owner and an explicit replacement deadline.

Disable session upload progress.

Apply this in startup configuration, such as the relevant php.ini:

session.upload_progress.enabled = 0

Restart every affected worker. This blocks confirmed session lifecycle paths, but other stale-state paths remain. Applications that depend on PHP's session upload-progress feature should check the effect on their progress indicators.

On PHP 8.5, disable fatal-error backtraces if patching is delayed.

fatal_error_backtraces = 0

This addresses a separate confirmed path and also requires worker replacement. Neither setting is a complete fix. PHP's stale-state advisory additionally recommends eliminating attacker-reachable fatal errors and problematic early configuration diagnostics. Suppressing diagnostic output does not remove the underlying condition.

Handle the OOM workaround cautiously.

PHP documents an administratively enforced memory_limit=-1 as a partial workaround for controllable PHP memory-limit failures. Underlying allocation failures can still reach vulnerable behavior, and removing the PHP limit introduces resource-exhaustion concerns.

The accompanying controls matter:

• Enforce decoded request-size limits at the frontend, including requests without a usable declared content length.
• Bound multipart complexity, input counts, and nesting where supported.
• Use appropriate container or cgroup resource boundaries, understanding their availability implications.
• Do not substitute RLIMIT_AS or RLIMIT_DATA, which can trigger the problematic allocation failure.

Treat this as a coordinated infrastructure change, not a standalone configuration trick. The OOM advisory explains the remaining limitations.

Does Session Strict Mode Prevent PHP2Shell?

Session strict mode is useful general hardening, but it is not an established PHP2Shell fix.

session.use_strict_mode = 1

The PHP session documentation explains that strict mode rejects uninitialized session IDs, helping prevent session fixation through session adoption. That protection addresses a different failure mode from interpreter memory corruption.

There is also a configuration caveat: a custom session handler must support the appropriate session-ID validation mechanism for strict mode to work as intended. Merely seeing the directive enabled does not establish effective protection with every handler.

Does Cloudflare Protect Against PHP2Shell?

Cloudflare announced PHP2Shell WAF protections for customers with WAF deployed, including Free plans. It still recommends updating PHP and keeping the protections enabled.

For a Cloudflare-backed PHP website, confirm the relevant ruleset is deployed, check its action and exclusions, and review matching security events. Treat this as an additional defense while completing origin remediation.

As an operational check, also examine whether alternate hostnames or direct origin access can reach the PHP service outside the protected route. An edge control only helps traffic that actually passes through it.

A pure JavaScript or TypeScript Worker has a different exposure profile. Cloudflare documents that Workers run on V8. Consequently, a deployment with no PHP component does not directly contain these PHP interpreter flaws. A Worker that calls a PHP backend still depends on that backend being patched. This distinction follows from the runtime architecture, not from the domain using Cloudflare DNS.

What to Check If Compromise Is Suspected

Being vulnerable does not prove that exploitation occurred. Conversely, installing the patch does not establish that an earlier intrusion has been removed.

For suspected compromise, use an incident-response workflow alongside remediation:

• Preserve relevant proxy, web-server, PHP, authentication, and hosting logs.
• Investigate unexpected PHP files, account changes, scheduled jobs, and outbound connections.
• Isolate suspicious instances from public traffic and sensitive services while preserving evidence.
• Replace compromised deployments with trusted patched builds and rotate potentially exposed credentials from a trusted environment.

Fatal errors and worker crashes can guide investigation, but they are not unique PHP2Shell indicators. PHP's advisory explicitly warns that the absence of relevant log entries is not proof of safety.

Conclusion

PHP2Shell remediation should end with a verified patched deployment. Temporary settings and WAF rules can reduce exposure, but they do not provide equivalent assurance.

Inventory the PHP runtimes serving your sites, apply the appropriate fixes, replace old workers, and record verification for every pool or replica. Close the task when the deployed environment has been checked—not merely when an update command finishes.