How to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619)

If your site runs on PHP, yes, until it is updated. That includes WordPress, Laravel, Drupal and any other PHP application, on your own server or on shared hosting. The bugs are in PHP itself, so updating WordPress or your plugins doesn’t fix them.

Apps built with Lovable, Bolt or v0 usually don’t run PHP: they are JavaScript frontends with Supabase or Node.js behind them. If you’re not sure, the next section shows how to check.

php -v

The command line and the web server can use different PHP versions, so check the one that serves your site too. On shared hosting it is in your control panel (in cPanel, “Select PHP Version” or “MultiPHP Manager”).

Linux distributions and some hosts patch PHP without changing its version number. If your version looks old, check your distribution’s or host’s advisory for these CVEs before concluding you’re exposed.

Many PHP servers also announce their version in a response header:

curl -sI https://your-site.com | grep -i x-powered-by
# X-Powered-By: PHP/8.3.35

1. On Debian or Ubuntu, install your distribution’s updated packages, then restart PHP-FPM or Apache.
2. With Docker, rebuild from a fixed image such as php:8.4.27-fpm and redeploy.
3. On shared hosting, check your host’s status page, and if you’re on 8.1 or older, switch to 8.2 or newer in the control panel.
4. Restart every PHP worker so the fixed version is the one running.
5. Set expose_php = Off in php.ini so your server stops announcing its version.

sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm   # or apache2

The PHP project lists settings that block the known attack paths, but in its own words they don’t make an installation safe:

memory_limit = -1
post_max_size = 8M                  ; 32M if you need file uploads
session.upload_progress.enabled = 0
fatal_error_backtraces = 0          ; PHP 8.5 only

Set them in php.ini, the FPM pool (php_admin_value) or the server configuration, not with ini_set() or .user.ini, then restart every worker. Keep upload_max_filesize below post_max_size. Since memory_limit = -1 removes PHP’s own memory cap, put a memory limit on the container or service instead.

A firewall in front of your site, such as Cloudflare’s, blocks known attack patterns for the traffic that goes through it. If you run PHP 8.1 or older and can’t update, CISA recommends taking the site offline until it is patched.

Look for PHP processes starting shells or downloading files, PHP files you didn’t write (often in upload folders), and unexpected outbound connections from the server. If you find any, assume the server is compromised: rebuild it from a clean source and change every secret it held, such as database passwords and API keys.

A scan of your server’s installed packages, php -v, or your host’s notice is the reliable way. A scan from the outside only sees the version if your server announces it, and since distributions patch without changing the number, that is a warning to check, not proof.

Afterprompt’s free scan reads the PHP version when your site announces it in the X-Powered-By or Server header, and flags anything below 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and every 8.1 or older, as possibly vulnerable. If your site hides its version, the scan can’t tell either way, so check php -v or ask your host. The scan also checks for files left public, like .env and .git, and our code scan checks the packages in your composer.lock for known vulnerabilities on every push, for free.

• PHP security advisory, 21 October 2026
• CISA alert: critical vulnerabilities in PHP