PHP2Shell Vulnerability: Am I Affected? How Do I Fix It?

Forward these to whoever has access to your code or servers. They run them in order, in one session, in Claude Code's Manual mode or another AI coding tool set to ask before it acts. Anthropic's security docs say reviewing commands is the user's job.

Prompt C: Find every website and server we run on PHP

What it does: Finds every place you run PHP, and its version. It changes nothing.

Ground rules for this session:
- This task is read-only. Do not install, upgrade, restart, edit or create anything, including phpinfo() or test files on a web server.
- Never ask me to paste passwords, API keys, SSH keys or .env files, and don't open or print them yourself (skip .env, wp-config.php and key files when searching). If a command needs a password, give me the command to run in my own terminal.
- Do not download or run any php2shell exploit, "PoC" or scanner from the internet (except OpenAI's official checker at github.com/openai/php2shell-checker, if I ask for it).
- Show me each command, and what it does, before you run it.
- If you can't verify something, say UNKNOWN. Never assume it's safe.

Task: check us for php2shell (CVE-2026-109618 and CVE-2026-109619). It's new, so use these facts from php.net's October 21, 2026 advisory (https://www.php.net/archive/2026.php#2026-10-21-5): safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer in the same branch. PHP 8.1 and older have no official release; some vendors ship patched packages.

Find every place we run PHP, and its version:
1. Code: Dockerfiles, docker-compose and Kubernetes files (FROM php:..., and images with PHP inside, such as the official wordpress, drupal or joomla images), CI files (.github/workflows, .gitlab-ci.yml), composer.json, .php-version, .tool-versions, and hosting or infrastructure config.
2. Servers: the PHP that serves the website (PHP-FPM, the Apache module, LiteSpeed or FrankenPHP), not only `php -v`, because they can differ. If a version looks old, check the package changelog for the two CVE numbers; Linux vendors often fix old versions without changing the number. If you can't reach a server from here, don't ask for access: give me the read-only commands to run there, and wait for me to paste back the output.
3. Managed hosting: tell me where the PHP version shows in the control panel, and draft a 3-sentence note asking the host to confirm the fix and the restart.
4. Other products: software we bought that has PHP built in (CISA says to include it). List what you find as UNKNOWN for me to check with the vendor.

Give me one table:
Where | Version running | How you know (file and line, or command output) | Safe? (Yes / No / UNKNOWN) | Next step
The PHP version in composer.json does not prove what the server runs.
Then add a 5-line, plain-English summary for a non-technical owner.

Prompt D: Plan and apply the update safely

What it does: Next, in the same session. It saves the logs, updates a test copy first, and stops for your approval before it touches the live site.

Ground rules: Never ask me to paste passwords or keys, and don't print secret files. Do not download or run any php2shell exploit or scanner. Show me each command, and what it does, before you run it. If you can't verify something, say UNKNOWN. If you can't reach a server, or a command needs a password, give me the command to run myself. Use only the official fix and its instructions: PHP's security notice (https://www.php.net/archive/2026.php#2026-10-21-5) and our host's or Linux vendor's security update. Never invent a workaround or edit PHP's own code.

Safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer in the same branch, or a vendor package whose changelog lists CVE-2026-109618 and CVE-2026-109619.

Plan the php2shell fix and apply it to a staging copy first.
1. Before changing anything, check free disk space, then save a compressed copy of production's web server, PHP-FPM, app and container logs from October 1, 2026 onward to an admin-only folder outside the public web folder. Restarts and log rotation can erase them.
2. Confirm a fresh backup or server snapshot of our files and database exists. If you can't see it yourself, tell me where to check and wait. Show me how we would restore it.
3. If we have no staging copy, stop and tell me. For an update within the same branch, I may choose to snapshot and patch production today. Do nothing until I choose.
4. On staging, move to the fixed package from the source we already use (Linux vendor, Docker tag or host panel). Upgrade only the PHP packages, and show me the package list before you install. Do not add new repositories or PPAs without asking me. If we run 8.1 or older, stop and give me 3 options: a vendor-patched package, an upgrade to 8.3 or newer (list what could break), or taking the site offline.
5. Restart every PHP process: PHP-FPM, Apache, LiteSpeed or FrankenPHP, plus long-running PHP workers such as queue workers. Replace every running container. A running process keeps the old PHP.
6. Prove it worked: show the version and package the website itself uses (not only `php -v`), run our tests, and check the homepage, login and a file upload. Test forms and checkout only after you confirm staging uses payment test mode and can't email customers; otherwise skip them. Check the error log for requests that now end at the memory limit: the fix adds a hard limit that skips shutdown handlers.
7. Show me exactly what changed, plus a rollback plan.
8. STOP. Do not touch production until I reply "approved for production". Then repeat steps 2 and 4 to 6 on production, and stop again.
9. Once production is patched, list by name only the passwords and keys to change: database passwords, payment and cloud API keys, then WordPress salts (changing the salts logs everyone out). Never show their values.
Once the fixed version is confirmed live, list any stopgap settings we added, especially memory_limit = -1 and any systemd memory cap, and ask me before removing them. Stopgaps are not the fix.

Prompt E: Check whether we were already hit

What it does: Saves and reads the logs, and deletes nothing. Run step 1 before the update (skip it if Prompt D already saved the logs). Run the rest after.

Ground rules: Never ask me to paste passwords or keys, and don't print secret files such as .env or wp-config.php. Do not download or run any php2shell exploit or scanner. Show me each command, and what it does, before you run it. If you can't reach a server, give me the commands to run myself.

Check whether anyone may have used php2shell (CVE-2026-109618 and CVE-2026-109619) against us.
Stay read-only: do not delete, restart or clean up anything.
1. First, check free disk space. Then copy the web server, PHP-FPM and app logs from October 1, 2026 onward, including rotated .gz files, `journalctl -u 'php*' --since 2026-10-01` output and Docker container logs, into one compressed file in a folder outside the website's public directory that only admins can read. This copy is the only write allowed. If it won't fit, stop and tell me. Then tell me how to download it off the server. Restarts and log rotation can erase evidence.
2. Search them for these leads:
   - POST requests (multipart uploads, if the logs record the content type) followed by "Allowed memory size" errors in the error log, or bursts of HTTP 500 errors
   - PHP worker crashes or unexplained restarts ("SIGSEGV", "Segmentation fault", "exited on signal"), including PHP workers stopped by an out-of-memory kill
   - PHP processes starting shells or download tools (sh, bash, curl, wget), if we have auditd or endpoint monitoring
   - in WAF logs or a ModSecurity audit log only (normal access logs don't record these): request bodies containing PHP_SESSION_UPLOAD_PROGRESS, and unusually large or garbled PHPSESSID cookies our server sent back
   These also show up on healthy sites. A match is a lead, not proof. Look for the pattern: the same IP sending upload-style POSTs followed by errors or crashes.
3. List .php files created or changed since October 1, by change time (ctime) as well as modified time (check upload, cache and tmp folders first), new admin users (use the app's own tools, such as wp-cli), new cron jobs including the web server user's crontab, and plugins we don't recognize.
4. For each finding, show the log line, the time and how worried I should be. Mask customer data and secrets.
5. List, by name only, the secrets on this server to change once it's patched: database passwords, payment and cloud API keys, then WordPress salts (changing the salts logs everyone out). Never show their values.
Clean results do not prove we are safe. If anything looks wrong, stop and tell me.

Using Codex? OpenAI published a free checker, php2shell-checker. To install it, tell Codex: $skill-installer install both skills from https://github.com/openai/php2shell-checker. It also runs from the command line with node phpcheck.js and your site's address. It reads only the PHP version number, from your site's headers or php -v on the server, so it can miss vendor fixes. Its README warns that UNKNOWN does not mean patched. Unofficial php2shell "exploit" and "scanner" projects appeared on GitHub on October 21 and 22. Don't let your AI run them.

Safe versions

Safe versions, from the php.net advisory.

• The researchers at Calif and Wiz say the bugs reach back to PHP 5.4, from 2012. PHP's own advisories list only the supported versions. PHP's security team also posted source-code fixes for 7.4, 8.0 and 8.1 for people who build PHP themselves.
• Every server setup is affected, including PHP-FPM, Apache, LiteSpeed and FrankenPHP. PHP rates Apache's mod_php setup as the highest risk.
• php -v shows the command-line PHP, which can differ from the PHP that serves your site.
• Linux vendors and cPanel often fix older versions without changing the number. For example, Ubuntu 24.04's fixed package still reports PHP 8.3.6.
• CVE advisories: CVE-2026-109618 and CVE-2026-109619.

Ubuntu and Debian

# Back up or snapshot first.
sudo apt update
# Read the list before you upgrade:
apt list --upgradable
sudo apt upgrade
# Find your PHP services:
systemctl list-units 'php*'
# Restart each one listed, for example:
sudo systemctl restart php8.3-fpm
# Apache with mod_php:
sudo systemctl restart apache2
# LiteSpeed or OpenLiteSpeed:
sudo systemctl restart lsws
# Show the installed PHP packages:
dpkg -l 'php*' | grep ^ii

• If the upgrade list includes your database server (MySQL or MariaDB) or the kernel, upgrade in a short maintenance window, or upgrade only the PHP packages.
• Compare the installed versions with the fixed versions on your vendor's page. To see the version PHP-FPM itself reports, run /usr/sbin/php-fpm8.3 -v (match your version).
• Ubuntu says a standard system update installs the fix (USN-8948-1). Ubuntu's CVE page lists the fixed packages. Ubuntu 20.04 and older get the fix only through Ubuntu Pro.
• Debian 12 and 13 have fixed packages (Debian's tracker). Debian 11 gets the fix only through Freexian's extended support.
• Using Ondřej Surý's PPA (ppa:ondrej/php)? Ubuntu's page doesn't cover it. Run the same commands, then check that the version meets the table above.

AlmaLinux and other Red Hat-family systems

AlmaLinux's steps:

# Back up or snapshot first.
sudo dnf clean metadata
sudo dnf upgrade 'php*'
# Find your PHP services:
systemctl list-units 'php*'
# Restart PHP-FPM (httpd for mod_php):
sudo systemctl restart php-fpm
# Check the changelog for the fix:
rpm -q --changelog php-common \
  | grep -E 'CVE-2026-10961[89]'

• Red Hat says RHEL 8, 9 and 10 are affected, some updates are out and more are in progress. Amazon Linux: ALAS page.
• Using Remi's repository? Remi says updates are out for PHP 7.4 to 8.5. Remi's multi-version packages have their own service names, such as php83-php-fpm (match your version). On release day, PHP's advisory urged Remi users to switch to distribution packages or build from source, because the volunteer-run repository would lag.

cPanel and WHM servers (run as root)

EasyApache 4 release 25.91 updates ea-php82 to ea-php85 and patches ea-php74, ea-php80 and ea-php81 without changing their version numbers. CloudLinux gives these steps:

# Back up or snapshot first.
yum clean all
yum update "ea-php*"
# CloudLinux PHP Selector (alt-php):
yum update "alt-php*"
# (use dnf on CloudLinux 8 to 10)
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm

On CloudLinux, a fixed ea-php package can show a lower number than PHP's own release. Check its changelog with the rpm command above; rpm -qa 'ea-php*' 'alt-php*' lists your package names.

Other control panels. On Plesk, DirectAdmin, Laravel Forge or RunCloud, use the panel's PHP update, then check the panel's status page or blog.

Windows

Download 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from PHP's Windows releases. IIS needs the Non-Thread Safe (NTS) build; Apache with mod_php needs the Thread Safe (TS) build. Back up your PHP folder, including php.ini. Put the new version in its place and copy php.ini back. Then recycle the IIS app pool (or run iisreset), or restart the Apache service. Built PHP from source on any system? Get the new versions from php.net/downloads.

Docker

The official php images now have 8.5.12, 8.4.27, 8.3.36 and 8.2.35 tags, in cli, apache and fpm versions. Pin the fixed version, rebuild and redeploy.

# Before
FROM php:8.3-apache
# After: pin the fixed version
FROM php:8.3.36-apache

A pinned tag means you bump it yourself for future fixes. Keeping the floating php:8.3-apache tag and rebuilding with --pull also gets this fix.

Before you replace a container, make sure uploads and site files live on a volume or bind mount, and back them up. Then replace every running container. A running container keeps its old PHP until you replace it.

# Your own Dockerfile:
docker build --pull -t my-site .
# Official wordpress, drupal or joomla
# image: pull and recreate
docker compose pull
docker compose up -d
# Confirm (use your service name):
docker compose exec wordpress php -v

The official 8.1 and older images are no longer updated and have no fixed tag, so plan an upgrade.

If you can't patch today

• Take it offline, or serve a static page. CISA says to take PHP systems offline until they're patched if you can't update right away. It says the same if you run PHP 8.1 or older. A WordPress maintenance-mode plugin won't help: security firm Sansec notes that PHP reads the request before your app runs.
• Firewall. Cloudflare says its free and paid WAF customers have been protected by default since 03:02 UTC on October 21. Paid plans should check that the Cloudflare Managed Ruleset is set to block. It protects only sites whose DNS records are proxied (orange cloud), so set your server to accept web traffic only from Cloudflare. On AWS WAF, add the PHP application rule group at version 2.3 or later; its PHP2Shell_BODY rule covers CVE-2026-109619. For CVE-2026-109618, AWS relies on the SizeRestrictions_BODY rule in its Core rule set, which blocks request bodies over 8 KB. Keep both rule groups on, with that rule set to block.
• Fix errors strangers can trigger. PHP's advisory lists timeouts ("Maximum execution time exceeded") and fatal errors that anyone can trigger on public pages as exposure to fix.
• Stopgap settings. PHP and php2shell.com say these lower the risk but do not make a server safe. display_errors = 0 is php2shell.com's advice only; PHP notes that hiding errors alone does not help.

; Stopgaps only. Not a fix.
; Use -1 only with the memory cap below:
memory_limit = -1
; Blocks uploads over 8 MB:
post_max_size = 8M
session.upload_progress.enabled = 0
display_errors = 0
; PHP 8.5 only:
fatal_error_backtraces = 0

• Set them where apps can't undo them. ini_set() and .user.ini files don't work for this. Apps and plugins can change memory_limit themselves, so set it as an admin value: php_admin_value[memory_limit] = -1 in the PHP-FPM pool, or php_admin_value memory_limit -1 in the Apache config.
• Cap memory outside PHP, or skip memory_limit = -1. With no PHP limit, one runaway request can use all the server's memory, and Linux may then stop your database. For PHP-FPM, run sudo systemctl edit php8.3-fpm (match your service name), add the lines below, then restart PHP. With mod_php, do the same for apache2. Size the cap to leave room for your database. Don't use RLIMIT_AS or RLIMIT_DATA. Can't add a cap? Skip memory_limit = -1 and use the other settings plus a WAF.

[Service]
MemoryMax=1G
OOMPolicy=continue

• OOMPolicy=continue keeps PHP running when the cap stops one worker. Without it, systemd stops the whole service.
• Need file uploads? Use post_max_size = 32M, and keep upload_max_filesize below it.
• Restart PHP afterward.
• After you update PHP, remove these temporary settings, especially memory_limit = -1, and restart.

Signs of attack

Save a copy of your logs first. Restarts and log rotation can erase them.

• Upload-style form requests (multipart) followed by memory errors or bursts of HTTP 500 errors. (Wiz)
• Very large or garbled PHPSESSID cookies that your server sends back. (Wiz)
• PHP workers crashing or restarting for no clear reason. (Wiz)
• PHP processes that start a shell or download tools. You need auditd or endpoint monitoring to see these. (CISA)
• Form uploads that contain PHP_SESSION_UPLOAD_PROGRESS. Amazon suggests searching back to at least October 17. (Amazon)

Request bodies and cookies show up only in WAF logs (for example, Cloudflare Security Events) or a ModSecurity audit log, not in normal access logs. A match is a lead, not proof. Clean logs don't prove you're safe either. PHP and Wiz both say so. The UK NCSC advises checking unpatched systems for backdoors.

Once patched, rotate the most valuable secrets on internet-facing servers that ran unpatched PHP: database passwords, payment and cloud API keys, then WordPress salts. Changing the salts logs everyone out.