Urgent: Critical PHP Core RCE (php2shell) and a Temporary Fix Until the Patch

On October 20, the PHP security team warned about two critical vulnerabilities in PHP, both rated CVSS v4.0 9.2. They are tracked as CVE-2026-109618 and CVE-2026-109619. Both are reported as remote code execution, which means an attacker could run code on your server without logging in. The details leaked before the patch, and early attacks have already been reported.

The official patch is scheduled for today, Wednesday, October 21, 2026, at 14:00 UTC (8:00 PM Bangladesh time).

Official announcement: php.net

How to mitigate php2shell until the patch

The most widely suggested temporary step is to disable session.upload_progress.enabled. Almost no site uses this feature (WordPress and Laravel don’t), so turning it off is generally safe.

Debian / Ubuntu

This script applies the setting to every installed PHP version (CLI, FPM, Apache) in one go, so you don’t have to repeat commands per version:

for dir in /etc/php/*/*/conf.d; do
  echo 'session.upload_progress.enabled = Off' \
    | sudo tee "$dir/99-disable-upload-progress.ini" > /dev/null
done

sudo systemctl restart 'php*-fpm.service'
systemctl is-active --quiet apache2 && sudo systemctl restart apache2

Then verify on PHP-FPM, since FPM is usually what serves your website, not the CLI:

for bin in /usr/sbin/php-fpm*; do "$bin" -i | grep -m1 session.upload_progress.enabled; done

You should see session.upload_progress.enabled => Off => Off.

No terminal? (cPanel, Plesk, shared hosting)

Add this line to your php.ini. In cPanel, use MultiPHP INI Editor; in Plesk, use PHP Settings → Additional directives. If the line already exists with On, change it to Off.

session.upload_progress.enabled = Off

Using Cloudflare?

Cloudflare has deployed WAF rules against this attack on all plans, including Free. They only protect you if your server doesn’t accept direct traffic that bypasses Cloudflare.

How to upgrade PHP when the patch is released

sudo apt update
sudo apt-get install --only-upgrade $(dpkg -l | awk '/^ii/ && $2 ~ /^php/ {print $2}')
sudo systemctl restart 'php*-fpm.service'

Expected fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These are not confirmed yet, so check php.net. If you use your distro’s own PHP packages (for example Ubuntu 24.04’s 8.3.6), the version number won’t change. The fix arrives as a backported package, so check your distro’s security notice instead. PHP 8.1 and older are end-of-life and won’t get an official fix, so upgrade those servers to a supported version.

Sources

• PHP: Upcoming Critical PHP Security Release
• Phoenix Security: PHP core RCE, CVE-2026-109618 and CVE-2026-109619
• Tenable: php2shell FAQ

Frequently asked questions

What is php2shell?

php2shell is the name of a public exploit chain for two critical vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619. The PHP security team rated both CVSS v4.0 9.2, and public reporting describes both as remote code execution.

Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?

PHP will publish the official list of affected versions with the security release. CERT-EU has said the issues could affect all PHP versions from PHP 5 onwards. Fixes are only expected for the supported 8.2, 8.3, 8.4 and 8.5 branches, so PHP 8.1 and older will stay vulnerable.

Does disabling session.upload_progress.enabled fix php2shell?

No. Turning it off is a widely suggested stopgap that reduces exposure, but PHP core developers have said the only real fix is upgrading PHP. Apply it now, then upgrade as soon as the patched release is out.

Is it safe to turn off session upload progress on a WordPress or WooCommerce site?

In almost every case, yes. WordPress, WooCommerce and Laravel don't use PHP's session upload progress feature. It only matters if you have custom code that shows file upload progress by reading it from the PHP session.

Does Cloudflare protect my site from php2shell?

Partly. Cloudflare has deployed WAF rules for known exploit vectors on all plans, including Free, but they only cover traffic that passes through Cloudflare. If your origin server accepts direct connections, attackers can bypass the WAF, and the rules are a stopgap, not a fix.

When is the PHP security patch released?

The PHP security team scheduled the release for Wednesday, October 21, 2026 at 14:00 UTC. The expected fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but confirm them on php.net. Distro-packaged PHP gets the fix as a backport without changing the version number.