PHP2Shell lets one request take over a PHP server. Attackers are already trying it.
Two critical flaws in PHP itself, exploitable without logging in and before your application code runs. We find every exposed PHP runtime you have, patch it, including the versions PHP no longer ships fixes for, and prove it worked.
- CVE IDs
- CVE-2026-109618
CVE-2026-109619 - Impact
- Remote code execution, memory disclosure
- Attack
- Remote, unauthenticated, before app code runs
- Affected
- PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed
- Fixed in
- 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
- 8.1, 8.0, 7.4
- Source backports only, no release
- Exploitation
- Attempts observed in the wild
- Patch released
- 21 Oct 2026 ·
Technical details
This isn't a plugin bug. It's in the PHP engine.
Secure application code doesn't protect you, because both flaws trigger before your app loads. Apache with mod_php is the highest-risk setup.
Out-of-memory corruption
An out-of-memory error mid-request leaves request data half set up. PHP's cleanup then treats that broken data as valid, which opens a path to remote code execution.
Stale state between requests
Request data outlives the memory it points to, and the next request on the same worker uses it. Researchers showed code execution and leaks of live memory, including passwords, tokens and API keys.
Why "we updated" often isn't true
The four gaps we look for first.
- 01Updating your app or CMS doesn't update PHP. The runtime is a separate upgrade.
- 02New packages do nothing until Apache, PHP-FPM and long-running workers restart.
- 03Linux distribution builds patch without changing the version number, so the version string can't tell you.
- 04PHP 8.1, 8.0 and 7.4 got source backports, not releases. Older versions got nothing.
Exposure check
Which PHP branch do you run?
Select your branch to see where you stand.
Scope
Much of the web can't just click "update."
of PHP sites still run version 7 or older. PHP shipped no PHP2Shell release for any of them.
of PHP 8 sites run 8.2. They can patch now, then lose security fixes on 31 December, in a few weeks.
is what PCI DSS allows to install critical patches after release. The PHP2Shell fixes shipped 21 October.
Who we help
Teams with no one on call for PHP.
Magento 2, Adobe Commerce and WooCommerce stores
Your developer has moved on, you're in scope for PCI DSS, and checkout runs on PHP no one has checked in a year. Adobe patches Magento, not the PHP underneath it.
Laravel, Symfony and custom PHP apps
Your engineers are shipping features, and customers are already asking whether you're affected. You need the fix and the evidence for your SOC 2 auditor.
Dozens of client sites to patch this week
We work through your client list under your name, and hand you a status report per site. Talk white-label →
Free exposure check
What you get back
A ranked report of what's exposed, PHP2Shell first, with the fix for each item. It's yours to keep whether or not you hire us.
- What PHP is actually running, not just what's installed
- PHP2Shell status per server and worker pool
- Interim hardening you can apply today
- A remediation plan with a fixed price
| Severity | Component | Finding | Fix |
|---|---|---|---|
| Critical | php 8.1 · mod_php | PHP2Shell, both CVEs. No official release for 8.1. | Move to 8.4.27+, or a patched LTS build as a bridge |
| High | php-fpm pools | Package updated, workers never restarted | Restart pools, verify the running binary |
| High | php.ini | Session upload progress enabled | Disable at server level as interim hardening |
| Medium | magento 2.4.6 | Standard support ended 11 Aug 2026 | Move to a supported release line |
| Medium | composer.lock | Packages with published advisories | Update or replace, test on staging |
How we work
Scan, harden, patch, prove.
- 01
Scan
We find every PHP runtime you have, check what's actually running in each worker pool, and rank everything else in the stack behind PHP2Shell.
- 02
Harden
Where a patch can't land today, we apply PHP's recommended interim measures at the server level to reduce exposure while the fix is prepared.
- 03
Patch
Fixed PHP on supported branches. For 8.1 and older: a patched build, a vendor LTS package, or an upgrade. Tested on staging, shipped with a rollback plan.
- 04
Prove
Before-and-after evidence for every server, and a CVE-by-CVE log for your assessor, auditor or customers.
Runtime patches buy time. We close the findings.
Long-term-support PHP builds are a good bridge, and we'll recommend one when an upgrade has to wait. They patch the runtime. Rolling them out, restarting every worker and fixing the rest of the stack is still on you.
| Comparison | LTS runtime subscription | Infraredtiming |
|---|---|---|
| What gets patched | The PHP runtime | Runtime, config, framework, packages |
| Who does the work | Your team rolls it out | We do, on staging first |
| Proof it worked | Vendor documentation | Running-process check on every server |
| How you pay | Annual subscription | Fixed price per engagement |
Services
Check free. Pay only for the fix.
A read-only check of your servers, with a ranked report and a fix plan you keep.
- PHP2Shell status per server
- Interim hardening steps
- Fixed quote for the fix
Fixed price per application, agreed before we start. PHP2Shell closed, with proof.
- Patched PHP on every server
- 8.1 and older: patched build or upgrade
- Workers restarted and verified
- Evidence pack for auditors and customers
So the next PHP2Shell isn't a fire drill.
- New PHP and package advisories tracked
- Critical fixes inside PCI's one-month window
- Quarterly evidence refresh
FAQ
Common questions
Our host says we're updated. Are we?
Maybe. Distribution builds can carry the fix without changing the version number, and workers that weren't restarted still run the old code. The free check looks at what's actually running.
We're behind Cloudflare. Aren't we covered?
It helps. Cloudflare shipped rules for the known attack paths, and also reported attackers changing payloads to get around them. Patching PHP is the only complete fix.
We're on PHP 8.1 or older. What now?
PHP published minimal source backports for 7.4, 8.0 and 8.1, not releases you can install. You need a patched build, a vendor LTS package, or an upgrade. We do whichever fits, and harden the server while it's prepared.
Will patching break our store or app?
We test on staging first, including checkout, login and admin, and ship with a rollback plan. The fix adds a hard memory limit, so we review your memory settings before go-live. Nothing reaches production without your sign-off.
Why not have our own developer do it?
You can. The free check's report is yours to keep, steps included. Hire us when your team doesn't have the time, or the servers are older than anyone remembers.
Does this make us PCI or SOC 2 compliant?
No vendor can promise that. Your assessor or auditor decides. We close the vulnerabilities and give them the evidence they ask for.
Patch released 2 days ago
Find out if you're exposed.
Tell us where to look. We'll send back your PHP2Shell status and a fixed-price plan by email.
Prefer to talk first? Book a 15-minute call
Or email hello@infraredtiming.com