PHP2Shell (CVE-2026-109618 & CVE-2026-109619): How to Patch or Upgrade PHP on WHM, cPanel and AWS VPS Servers

On 21 October 2026 the PHP project shipped emergency releases for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. Both are rated CVSS 9.2 and both can lead to unauthenticated remote code execution — an attacker running their own code on your server without logging in to anything. Details leaked a day before coordinated disclosure, exploit attempts have already been observed, and every PHP application is in scope: WordPress, Laravel, OpenCart, Magento, and every custom PHP app, because the bugs are in PHP itself, not in any framework or plugin.

This post covers what PHP2Shell is, how to check whether your server is affected, and the exact steps to patch it on the two setups I manage most: WHM/cPanel servers and plain Linux VPS instances on AWS. If your site runs an end-of-life PHP version, there is a section for you too, because your situation is more urgent, not less.

What is the PHP2Shell vulnerability?

PHP2Shell is two separate bugs in how PHP manages per-request memory, found in the engine itself:

• CVE-2026-109618 — when PHP hits an out-of-memory condition at the wrong moment, internal request data can be left only partially initialized. During request cleanup, PHP can then treat that invalid data as valid, which an attacker can steer into executing code.
• CVE-2026-109619 — request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker process can then use that stale data before it is reset, again opening a path to code execution.

Two things make this pair unusually serious. First, the bugs are old: they affect PHP versions going back to 5.4, so effectively every PHP 5, 7 and 8 install in production today. Second, the reporting so far is consistent on one point: no php.ini setting, WAF rule or configuration change fully mitigates these flaws. The fix is a patched PHP binary, full stop. The GitHub advisories are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

Affected and fixed PHP versions

Affected: PHP 5.4 up to and including 8.5.11. Fixed in the releases published 21 October 2026:

• PHP 8.5 → fixed in 8.5.12
• PHP 8.4 → fixed in 8.4.27
• PHP 8.3 → fixed in 8.3.36
• PHP 8.2 → fixed in 8.2.35

Notice what is missing: PHP 8.1, 8.0, every 7.x and every 5.x. Those branches are end-of-life and the PHP project does not patch them. If your site runs on one of them — and a large share of older WordPress, OpenCart 3 and Laravel installs do — there is no update to install. Skip ahead to the end-of-life section, because your path is different.

Step 1: Find out what you are actually running

Check the version PHP reports for the web, not just the CLI — on most servers they can differ:

# CLI version (often NOT what your site uses)
php -v

# what PHP-FPM pools exist on a plain VPS
ls /etc/php/*/fpm/pool.d/ 2>/dev/null; php-fpm8.3 -v 2>/dev/null

# on WHM/cPanel: per-domain versions in one list
whmapi1 php_get_vhost_versions | grep -E 'vhost|version'

In WHM you can also see it under MultiPHP Manager, which lists the PHP version assigned to every domain. Check every domain, not just the main one — it is common to find one forgotten site pinned to ea-php74 while everything else moved on. On a server with multiple apps, the oldest PHP version on the box sets your real exposure, because one compromised vhost is usually enough to reach the rest.

Step 2a: Update PHP on a WHM/cPanel server

cPanel ships patched ea-php packages through its normal repositories shortly after an upstream PHP release, so on a healthy WHM server this is a package update, not a migration:

1. Log in to WHM and run Software > Update System Software, or from SSH:

# update all EasyApache packages, including ea-php82/83/84
yum update -y 'ea-*'    # AlmaLinux/CloudLinux 8: dnf update -y 'ea-*'

# confirm the patched version is installed
/opt/cpanel/ea-php83/root/usr/bin/php -v   # expect 8.3.36 or later

2. Restart Apache and PHP-FPM so every worker picks up the new binary: Restart Services in WHM, or /scripts/restartsrv_apache_php_fpm && /scripts/restartsrv_httpd.
3. In MultiPHP Manager, confirm no domain is still assigned to an unpatched version such as ea-php74 or ea-php81. Assigning a domain to a newer version here is also how you fix that — see the compatibility notes below before you flip production.

If WHM offers no update for the version a domain uses, that version is end-of-life on your server. cPanel keeps shipping the EOL packages so old sites keep running, but they will never receive this fix. CloudLinux customers can buy time with PHP hardened by their extended lifecycle support, but treat that as a bridge, not a destination.

Step 2b: Update PHP on an AWS VPS (EC2 or Lightsail)

On a self-managed Ubuntu or Debian server, PHP usually comes from the distro repository or the widely used ondrej/php packaging. Either way the update is the same shape:

sudo apt update
sudo apt upgrade -y 'php8.3*'        # or php8.2*/php8.4* to match your version
sudo systemctl restart php8.3-fpm    # workers keep the old binary until restarted
php-fpm8.3 -v                        # expect 8.3.36 or later

On Amazon Linux 2023: sudo dnf upgrade -y php8.3\* followed by sudo systemctl restart php-fpm. Three AWS-specific notes from doing this across client fleets:

• Unattended upgrades are not enough today. Even where automatic security updates are enabled, they run on a timer. For an actively probed RCE, update by hand now rather than waiting for the nightly run.
• Restart PHP-FPM explicitly. CVE-2026-109619 is precisely about stale state in long-lived worker processes. Installing the package without restarting the service leaves the vulnerable code running.
• Check images, not just instances. If you bake AMIs or Docker images with PHP in them, rebuild them from the patched packages, or your next autoscaling event quietly redeploys the vulnerable version.

While you are on the box it is worth confirming the basics hold — firewall, SSH policy, automatic security updates — which I keep as a reusable list in my Linux server hardening checklist.

Running PHP 8.1 or older? There is no patch for you

This is the uncomfortable half of PHP2Shell. If your application is pinned to PHP 5.6, 7.2, 7.4, 8.0 or 8.1 — usually because an old theme, extension or codebase breaks on anything newer — you are exposed to a critical, actively probed RCE with no vendor fix, and configuration can only reduce the blast radius, not remove it. Realistically you have three options, in order of preference:

1. Upgrade the PHP version and fix the application. On WHM, MultiPHP Manager lets you move one domain at a time, so a staging copy of the site can be tested on PHP 8.3 or 8.4 while production stays untouched. The application-side work — what actually breaks in WordPress, Laravel, OpenCart and Magento and how to fix it — is its own topic, and I have written it up in how to upgrade an old PHP application or CMS to PHP 8.
2. Buy time with vendor-hardened EOL PHP. CloudLinux ELS and similar programs backport security fixes to end-of-life PHP versions. Whether and when they cover these specific CVEs is up to the vendor, so verify before relying on it — and still schedule the real upgrade.
3. Isolate what you cannot upgrade yet. If a legacy app genuinely cannot move this month, put it behind a WAF, cap post_max_size and memory_limit to sane values, disable unused PHP functions, and separate it from other sites so a compromise does not spread. Every published analysis agrees these measures reduce exposure but do not fully mitigate PHP2Shell.

How to check whether you were already hit

Exploit attempts were observed within a day of disclosure, so if your server sat unpatched this week, spend ten minutes looking for the usual aftermath of a PHP RCE: PHP files recently modified or created that you did not deploy, unexpected processes owned by the web user, cron entries you did not add, and outbound connections from the web server. A quick triage:

# PHP files changed in the last 3 days under the web root
find /var/www /home/*/public_html -name '*.php' -mtime -3 2>/dev/null

# processes and listeners owned by the web user
ps -u www-data -f; ss -tulpn | grep -Ev '(:22|:80|:443)\b'

# web-user crontabs that should usually be empty
crontab -u www-data -l 2>/dev/null

If anything looks wrong, patching alone does not evict an attacker who is already in — backdoors survive PHP updates. That cleanup is exactly what my website malware removal service covers: find the entry point, remove every shell and persistence mechanism, then patch and harden so it does not recur.

Need it handled today?

If you would rather not do this yourself, this is bread-and-butter work for me: patching PHP across WHM/cPanel and AWS VPS servers, moving domains off end-of-life versions, and locking the server down afterwards through my server security hardening service. A single-server patch and check is a small job at $20/hour; a fleet, or an upgrade off PHP 7.x with application fixes, gets a fixed quote in writing after a short audit. Either way you get a written record of what was running, what was changed and what was verified.

Frequently asked questions