PHP2Shell: what to do
PHP2Shell is two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619. They can let anyone on the internet run code on your web server. They affect sites running PHP through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed. Fixed PHP versions came out on 21 October 2026.
Step 1: update PHP. That's the real fix. Everything else on this site only lowers the risk until you can.
Am I affected?
| Your PHP | Safe from |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | no official fix: upgrade |
Ubuntu, Debian and Red Hat may patch older-looking versions. Check with your vendor.
Use the tool
One PHP file, nothing to install. Run it from your project folder (Linux / macOS):
curl -fsSL https://wasdthedebugger.github.io/php2shell/fix | php
Need admin rights to edit PHP's config? Use | sudo php. Prefer to read it first, or on Windows? Download it instead.
It asks simple questions, shows what it will change, backs up first, and can undo. How to run it.
The fixes
- Update PHP (the real fix)
- Turn off the memory limit CVE-2026-109618
- Lower the max request size CVE-2026-109618
- Keep the upload limit below the request limit CVE-2026-109618
- Turn off session upload progress CVE-2026-109619
- Turn off fatal error backtraces (PHP 8.5) CVE-2026-109619
- Limit request sizes in the web server CVE-2026-109618
- Limit memory outside PHP CVE-2026-109618
- Settings in your project that undo the fixes
Not sure where your config lives or how to restart PHP? See your setup.