Rook

Uh oh

**PHP2Shell: critical PHP vulnerability, patch now**

**Share this with anyone you know who owns a site who uses PHP, especially other providers/my competition I don't care anyone whos cheats you use if they do not fix it NOW all your info is at risk!**

What it is: two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), rated critical. Anyone on the internet can run code on your server without logging in. The bug is in the PHP interpreter, not in any one app, so WordPress, Invision, Laravel, Magento and every other PHP site is affected. Every version back to PHP 5.4 is vulnerable. Details leaked on Oct 20, the patch came out Oct 21, and attacks are already happening.

It can also leak server memory to the attacker, including passwords, session tokens and API keys.

Are you affected? Yes, if your server runs PHP and serves web traffic (PHP-FPM, Apache mod_php, LiteSpeed, etc.). Sites that don’t use PHP (Node, Python/Flask, Shopify, etc.) are not affected.

Check your version

bash
php -v

Patch

Fixed upstream versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35

PHP 8.1 and older get no official fix. However, Ubuntu backported it:

Ubuntu 22.04 (stock PHP 8.1): fixed in 8.1.2-1ubuntu2.28
Ubuntu 24.04 (stock PHP 8.3): fixed in 8.3.6-0ubuntu0.24.04.13
Ubuntu 20.04 and older: needs Ubuntu Pro (ESM)

On Ubuntu/Debian, swap 8.1 for your version:

bash
sudo apt update && sudo apt install --only-upgrade 'php8.1*' -y && sudo systemctl restart php8.1-fpm

Confirm it worked:

bash
dpkg -l php8.1-fpm | tail -1 && systemctl is-active php8.1-fpm

If you get a “which services to restart” screen during the update, keep the defaults and hit OK.

If you’re on shared hosting, ask your host to patch now or move you to a supported PHP version.

After patching

Rotate admin passwords, API keys, bot tokens and payment keys stored on the server, because of the memory leak.
Check for signs of compromise: PHP files changed recently, unknown processes running as www-data, new SSH keys or users, crontab changes, and PHP-FPM segfaults or “Allowed memory size” errors in the logs.