PHP2Shell Vulnerability (CVE-2026-109618 & CVE-2026-109619): 7 Simple, Safe Fixes for Sri Lanka Websites

Also on bkdevops.lk: https://bkdevops.lk/php2shell-vulnerability-fix-sri-lanka-smes/

The PHP2Shell vulnerability is an urgent warning for every business running a WordPress website, online store or custom PHP portal. In late October 2026, the PHP team disclosed two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2) that allow unauthenticated attackers to run commands on unpatched servers before application code even runs.

For a business in Colombo, Kandy, Kurunegala or anywhere in Sri Lanka, a server compromise can expose customer records, deface pages or turn a website into a spam relay. This guide explains how the PHP2Shell vulnerability works, how attackers use it to drop hidden web shells, the signs of compromise to check today, and seven simple, safe steps to patch and harden your server.

What is the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619)?

On 21 October 2026, the PHP project released emergency updates for two runtime flaws nicknamed PHP2Shell. Active exploitation was already underway in the wild, and on 26 October 2026 the US Cybersecurity and Infrastructure Security Agency added both flaws to its CISA Known Exploited Vulnerabilities alert.

Unlike a plugin bug, the PHP2Shell vulnerability sits inside the PHP engine itself and affects how the server parses incoming HTTP requests:

• CVE-2026-109618 (out-of-memory cleanup corruption): When a crafted HTTP POST or multipart request triggers an out-of-memory error while PHP is setting up request data, the cleanup routine processes partially initialised pointers and executes code during request shutdown, before WordPress or your app sees the request.
• CVE-2026-109619 (stale worker state reuse): When a fatal error interrupts native code mid-execution, internal state can outlive its memory and get reused by a later request on the same PHP worker process, leaking memory addresses and enabling remote code execution.

According to Datadog Security Labs' technical analysis, every web-serving PHP setup is affected, including Apache with mod_php (rated highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

How attackers turn the PHP2Shell vulnerability into a web shell

The name comes from what attackers do immediately after triggering the flaw: they jump straight from PHP to a shell. Once an automated scanner hits a vulnerable server, it runs a command to drop a web shell into a writable folder.

A web shell is a hidden .php script disguised as a normal website file. As long as that script stays on disk, the intruder does not need to trigger the PHP2Shell vulnerability again. Through the web shell, an attacker can browse folders, read wp-config.php database credentials, inject fake payment pages or SEO spam, and create rogue admin accounts.

Why Sri Lanka WordPress and PHP websites are at risk

Many business owners assume their site is safe because their WordPress plugins update automatically. However, because the PHP2Shell vulnerability affects the underlying PHP runtime on the server, a WordPress login page or security plugin alone cannot block the initial exploit request.

Across Sri Lanka, many company sites, WooCommerce stores and booking portals run on shared hosting or unmanaged VPS servers that stay on older point releases of PHP 8.1, 8.2 or 8.3. If the server runtime is unpatched, any reachable .php page exposes the vulnerable parser.

How to spot a PHP2Shell vulnerability compromise on your server

Before you update PHP and move on, check whether an automated scanner has already tested your site since mid-October 2026. Look for these indicators of compromise (IoCs):

• Suspicious .php files in upload or temp folders: Check wp-content/uploads/, wp-content/upgrade/, wp-content/cache/ and /tmp for any .php, .phtml or .phar files. Media folders should hold only images, PDFs and videos, never executable code.
• Modified core files or obfuscated code: Look for unexpected recent edits to index.php, wp-config.php, .htaccess or theme functions.php files, or scripts using eval(, base64_decode(, gzinflate( or shell_exec(.
• Memory-exhaustion spikes and worker crashes in logs: Check Apache, Nginx and php-fpm error logs for repeated Allowed memory size exhausted errors during request startup, large multipart POST requests, or worker crashes (SIGSEGV).
• Unexpected shell processes or outbound connections: On a VPS or cloud server, check whether www-data, nginx or apache has spawned sh, bash, curl, wget or nc, or opened unknown outbound connections.
• Unfamiliar admin users or cron jobs: Check WordPress Users for unknown administrators and inspect wp-cron or Linux crontab tasks that re-download malware.

If you spot any of these warning signs, isolate the site first and follow our recovery guide on what to do when a WordPress site is hacked.

7 simple steps to fix the PHP2Shell vulnerability and harden PHP

Protecting your site takes two steps: patching the PHP runtime so the PHP2Shell vulnerability cannot be triggered, and hardening your server so a web shell cannot run even if a plugin flaw appears later.

Step 1: Patch PHP immediately to a fixed release

Only a runtime update fixes the PHP2Shell vulnerability completely. Upgrade every internet-facing server to the patched versions released on 21 October 2026:

• PHP 8.5: update to 8.5.12 or later
• PHP 8.4: update to 8.4.27 or later
• PHP 8.3: update to 8.3.36 or later
• PHP 8.2: update to 8.2.35 or later

If your site still uses PHP 8.1 or older, upgrade to PHP 8.3 or 8.4 (matching the official WordPress server requirements) or apply your Linux vendor's backported security package immediately. After updating packages or containers, restart php-fpm, Apache or LiteSpeed so no worker keeps running the old runtime in memory.

Step 2: Lock down dangerous functions in php.ini

Most WordPress sites and business apps never need PHP to launch an operating-system shell. Blocking command-execution functions in php.ini makes it much harder for an exploit or dropped script to run server commands:

disable_functions = exec, passthru, shell_exec, system, proc_open, popen, pcntl_exec, show_source

Partial workarounds such as only setting session.upload_progress.enabled = 0 do not fully stop the PHP2Shell vulnerability. Always pair php.ini hardening with the real patch.

Step 3: Block PHP execution inside uploads and cache folders

When exploiting the PHP2Shell vulnerability, attackers usually drop web shells into wp-content/uploads/ because that folder must be writable for media uploads. Stop your web server from executing scripts inside wp-content/uploads/, as advised in the official WordPress hardening guide:

• On Apache or LiteSpeed: Add wp-content/uploads/.htaccess with <FilesMatch "\.(?i:php|phtml|phar|php[0-9])$"> and Require all denied.
• On Nginx: Add location ~* ^/wp-content/uploads/.*\.(php|phtml|phar)$ { deny all; } before your main PHP block and reload Nginx.

Step 4: Harden file permissions and wp-config.php

Tight permissions stop a compromised script from altering core files or reading other sites on the server:

1. Set directories to 755 (or 750) and regular files to 644.
2. Restrict wp-config.php to 600 or 640 so other system users cannot read database credentials.
3. Disable the built-in WordPress code editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.

Step 5: Scan for hidden web shells and enable a firewall

Once you patch the PHP2Shell vulnerability, run a full malware scan and compare all WordPress core, theme and plugin files against official checksums (with WP-CLI wp core verify-checksums or Wordfence). Place a reverse-proxy Web Application Firewall (WAF) in front of the site to filter malformed multipart requests before they reach PHP. Finally, rotate your database password, regenerate WordPress security salts, and turn on two-factor authentication for every admin. Our guide on why 2FA is non-negotiable explains how.

Step 6: Keep automated off-site backups before and after patching

Take a clean snapshot before changing server packages, and keep automated daily backups stored off-site rather than only inside wp-content/ on the same disk. If an attacker drops a web shell through the PHP2Shell vulnerability, any backup stored in the same web root can be deleted or poisoned. See our guide to backups in web hosting and include a monthly restore test in your WordPress maintenance checklist.

Step 7: Review customer data duties and hosting isolation

If you find a web shell on an online store or booking portal, check whether customer names, phone numbers, emails or order records were accessed. Sri Lanka's Personal Data Protection Act, No. 9 of 2022 expects businesses to protect personal data with appropriate safeguards and act responsibly if a breach occurs. Serious cyber incidents can also be reported via the Sri Lanka CERT website.

If your host cannot tell you which exact PHP point release you are running, review our checklist on choosing web hosting for Sri Lanka SMEs.

Quick checklist against the PHP2Shell vulnerability

Use this checklist with your developer or hosting provider today to confirm your site is protected against the PHP2Shell vulnerability:

• PHP updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a verified vendor-patched build
• php-fpm, Apache or LiteSpeed worker processes restarted after patching
• wp-content/uploads/, cache/ and /tmp checked for rogue .php, .phtml or .phar files
• Error logs checked for unusual memory-exhaustion spikes or worker crashes
• disable_functions set in php.ini to block exec, shell_exec, system, passthru, proc_open and popen
• .htaccess or Nginx rules blocking PHP execution inside wp-content/uploads/
• DISALLOW_FILE_EDIT enabled and wp-config.php permissions locked down
• Full checksum and malware scan completed, with 2FA enabled for all admins
• Automated off-site backups verified and stored outside the web server

How BK DevOps can help

Keeping up with server advisories like the PHP2Shell vulnerability is tough when you are busy running a business. BK DevOps helps Sri Lanka SMEs audit PHP versions, clean and harden WordPress websites, lock down wp-content/uploads/, configure automated off-site backups and handle monthly maintenance. If you would like a practical security check of your server and website, explore our services or contact us.