# Urgent: Critical PHP Core RCE (php2shell) and a Temporary Fix Until the Patch

Two critical PHP RCE bugs (CVE-2026-109618/109619, CVSS 9.2) leaked before the patch. Temporary php.ini fix for Ubuntu, cPanel and Plesk, and how to upgrade.

> Source: https://storesuite.dev/blog/php2shell-critical-php-rce
> Published: 2026-10-21 · By Md Aminur Islam

<Callout title="TL;DR">

- Two critical PHP core bugs, **CVE-2026-109618** and **CVE-2026-109619** (dubbed php2shell), are rated **CVSS 9.2** and reported as remote code execution.
- The fix ships on **October 21, 2026 at 14:00 UTC**. Upgrading PHP is the only real fix.
- Until then, set `session.upload_progress.enabled = Off` and restart PHP-FPM / Apache.
- PHP 8.1 and older are end-of-life and won't get a fix.

</Callout>

On October 20, the PHP security team warned about two critical vulnerabilities in PHP, both rated **CVSS v4.0 9.2**. They are tracked as **CVE-2026-109618** and **CVE-2026-109619**. Both are reported as remote code execution, which means an attacker could run code on your server without logging in. The details leaked before the patch, and early attacks have already been reported.

**The official patch is scheduled for today, Wednesday, October 21, 2026, at 14:00 UTC (8:00 PM Bangladesh time).**

Official announcement: [php.net](https://www.php.net/archive/2026.php#2026-10-20-1)

## How to mitigate php2shell until the patch

The most widely suggested temporary step is to disable `session.upload_progress.enabled`. Almost no site uses this feature (WordPress and Laravel don't), so turning it off is generally safe.

<Callout type="warn" title="This is a mitigation, not a fix">
This only reduces the risk. It does **not** fix the bug. PHP core developers have said the only real fix is upgrading PHP.
</Callout>

### Debian / Ubuntu

This script applies the setting to every installed PHP version (CLI, FPM, Apache) in one go, so you don't have to repeat commands per version:

```bash
for dir in /etc/php/*/*/conf.d; do
  echo 'session.upload_progress.enabled = Off' \
    | sudo tee "$dir/99-disable-upload-progress.ini" > /dev/null
done

sudo systemctl restart 'php*-fpm.service'
systemctl is-active --quiet apache2 && sudo systemctl restart apache2
```

Then verify on PHP-FPM, since FPM is usually what serves your website, not the CLI:

```bash
for bin in /usr/sbin/php-fpm*; do "$bin" -i | grep -m1 session.upload_progress.enabled; done
```

You should see `session.upload_progress.enabled => Off => Off`.

### No terminal? (cPanel, Plesk, shared hosting)

Add this line to your `php.ini`. In cPanel, use **MultiPHP INI Editor**; in Plesk, use **PHP Settings → Additional directives**. If the line already exists with `On`, change it to `Off`.

```ini
session.upload_progress.enabled = Off
```

### Using Cloudflare?

Cloudflare has deployed WAF rules against this attack on all plans, including Free. They only protect you if your server doesn't accept direct traffic that bypasses Cloudflare.

## How to upgrade PHP when the patch is released

<Callout type="warn" title="Upgrade as soon as it ships">
Update PHP as soon as the official patch is out, then restart PHP-FPM / Apache.
</Callout>

```bash
sudo apt update
sudo apt-get install --only-upgrade $(dpkg -l | awk '/^ii/ && $2 ~ /^php/ {print $2}')
sudo systemctl restart 'php*-fpm.service'
```

Expected fixed versions are **8.5.12, 8.4.27, 8.3.36 and 8.2.35**. These are not confirmed yet, so check php.net. If you use your distro's own PHP packages (for example Ubuntu 24.04's `8.3.6`), the version number won't change. The fix arrives as a backported package, so check your distro's security notice instead. **PHP 8.1 and older are end-of-life and won't get an official fix**, so upgrade those servers to a supported version.

## Sources

- [PHP: Upcoming Critical PHP Security Release](https://www.php.net/archive/2026.php#2026-10-20-1)
- [Phoenix Security: PHP core RCE, CVE-2026-109618 and CVE-2026-109619](https://phoenix.security/php-core-rce-cve-2026-109618-109619-critical-remote-code-execution/)
- [Tenable: php2shell FAQ](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)

## Frequently asked questions

### What is php2shell?

php2shell is the name of a public exploit chain for two critical vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619. The PHP security team rated both CVSS v4.0 9.2, and public reporting describes both as remote code execution.

### Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?

PHP will publish the official list of affected versions with the security release. CERT-EU has said the issues could affect all PHP versions from PHP 5 onwards. Fixes are only expected for the supported 8.2, 8.3, 8.4 and 8.5 branches, so PHP 8.1 and older will stay vulnerable.

### Does disabling session.upload_progress.enabled fix php2shell?

No. Turning it off is a widely suggested stopgap that reduces exposure, but PHP core developers have said the only real fix is upgrading PHP. Apply it now, then upgrade as soon as the patched release is out.

### Is it safe to turn off session upload progress on a WordPress or WooCommerce site?

In almost every case, yes. WordPress, WooCommerce and Laravel don't use PHP's session upload progress feature. It only matters if you have custom code that shows file upload progress by reading it from the PHP session.

### Does Cloudflare protect my site from php2shell?

Partly. Cloudflare has deployed WAF rules for known exploit vectors on all plans, including Free, but they only cover traffic that passes through Cloudflare. If your origin server accepts direct connections, attackers can bypass the WAF, and the rules are a stopgap, not a fix.

### When is the PHP security patch released?

The PHP security team scheduled the release for Wednesday, October 21, 2026 at 14:00 UTC. The expected fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but confirm them on php.net. Distro-packaged PHP gets the fix as a backport without changing the version number.