Kishmish managed hosting clients: no action is needed. We patched every affected server in our managed hosting environment, and our monitoring blocked the exploitation attempts it detected. If your website is hosted somewhere else, read on to find out what to check.
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in PHP, the programming language behind WordPress, WooCommerce, Drupal, Joomla and a large share of the web. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The first is triggered when PHP runs out of memory partway through setting up a request. The second lets internal data outlive the memory it points to, so the next request on the same PHP worker can act on leftover data.
What makes this serious is that both flaws are rated 9.2 out of 10 on the CVSS v4.0 scale and let an unauthenticated attacker run code on the server. In plain terms, an attacker doesn’t need a password or account to take control of an unpatched web server.
Is it being exploited?
Yes. A working exploit already exists, and it succeeds with a single unauthenticated request. Amazon’s threat intelligence team recorded an exploitation attempt on October 17, 2026, four days before the flaws were publicly disclosed. Security firm watchTowr has also seen exploitation since October 21, 2026.
Which PHP versions are affected?
Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Servers running PHP as an Apache module face the highest risk, because an attack can succeed before the website’s own code runs.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Older versions: PHP 8.1, 8.0 and 7.4 have no official fixed release; they need a Linux distribution or long-term support vendor package, PHP’s minimal source backports, or an upgrade. PHP 7.3 and older, including PHP 5, will not be fixed at all and must be upgraded.
What should website owners do?
If your website runs on PHP and isn’t managed by Kishmish, ask your hosting provider or web developer these questions today:
- Has PHP been updated? Every PHP installation should be updated to the fixed release for its version, starting with internet-facing servers, using the Linux distribution’s updated packages where available.
- Were PHP workers restarted? The fix doesn’t take effect until all PHP workers are restarted after the update.
- Is the site on an outdated PHP version? If it’s running PHP 8.1 or older, it needs a vendor backport or an upgrade.
- Can’t patch right away? Any PHP system that can’t be updated immediately should have its internet access restricted. The UK’s National Cyber Security Centre recommends taking unpatchable systems offline.
A configuration tweak alone won’t solve this. PHP has said that no configuration change fully mitigates these vulnerabilities. Updating PHP is the fix.
How Kishmish responded
When the vulnerability was disclosed, our team:
- Identified every hosting environment that could be affected
- Applied security patches to vulnerable systems
- Verified the patches deployed across our managed hosting servers
- Confirmed that client websites stayed online and protected
Keeping patch levels current, monitoring for threats and moving quickly on critical vulnerabilities are part of every Kishmish managed hosting plan. We’ll keep watching guidance on PHP2Shell and contact affected clients directly if anything else is needed.
Not sure if your website is exposed?
If you aren’t sure who maintains your website or what version of PHP it runs, we can help. Kishmish provides managed hosting, website security and managed IT services for organizations in Syracuse and across upstate New York.
Contact us at [email protected] or 315.478.8172.