PHP2Shell Patching, Migration and Vulnerability Guide With Solutions

PHP2Shell is considered the worst exploit that has happened to PHP. This is because it doesn't even rely on code being executed to successfully exploit, all it needs is Apache and PHP to be installed even if there is no website or .php file accessible.

There is no mitigation to stop it. Since the CVE was released, there is now confirmation of successful exploits in the wild. Some insiders also claim there are exploits that work on almost any PHP configuration and conversion that is vulnerable.

The quick end of the story is that this exploit is a CVSS of 9.2 and was released on October 21st. If you have not installed the latest version of PHP since then, you are vulnerable.

What Is the Impact?

In short hackers can gain full access to your site, server, data and even databases because of this exploit. Some people falsely assume that "my site is working so it's OK". Hackers will often choose to just exfiltrate/steal your business information and customer information with this exploit, which means in most cases you have been silently hacked.

Am I Impacted?

If your PHP was not updated on October 21st to the new releases of that day to one in the chart below, you are vulnerable and it's just a matter of time.

The vulnerabilities are together known as :

CVE-2026-109618

CVE-2026-109619

Which versions of PHP are vulnerable

Rather than listing which ones are vulnerable, understand that the only versions that are NOT vulnerable are the specific versions listed below.

The key thing to understand is that PHP 5.x, PHP 7.x and PHP 8.1 are vulnerable and do not have any patch for this CVE.

Branch	Patched release (October 21st)	PHP support status
8.5	8.5.12	Active support until December 31, 2027
8.4	8.4.27	Active support until December 31, 2026
8.3	8.3.36	Security fixes only until December 31, 2027
8.2	8.2.35	Security fixes only until December 31, 2026

For example PHP 8.5.12 and higher is not vulnerable to this CVE but 8.5.11 is, so make sure you carefully look at the full version and not just 8.5

How Can You Check Which Version of PHP You Have?

From the CLI:

We just type php -v

php -vPHP 8.5.12 (cli) (built: Oct 28 2026 01:20:43) (NTS) Copyright (c) The PHP Group Built by https://github.com/docker-library/php Zend Engine v4.5.12, Copyright (c) Zend Technologies with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

We can see above it says PHP 8.5.12 and since it is the same or newer than 8.5.12 in the chart above it is not vulnerable and has been patched.

PHP 7 Example

php -v PHP 7.4.33 (cli) (built: Nov 15 2022 06:01:17) ( NTS ) Copyright (c) The PHP Group Zend Engine v3.4.0, Copyright (c) Zend Technologies

We can see it is PHP 7.4.33 all we need to know is that PHP 7 is not at all supported anymore and doesn't match any "Patched Release" in the chart from earlier.

PHP 8.1 Example:

From the chart above we know it is vulnerable since PHP 8.1 is not supported.

PHP 8 Sneaky Example:

php -v PHP 8.2.34 (cli) (built: Oct 21 2026 00:35:13) (NTS) Copyright (c) The PHP Group Zend Engine v4.2.34, Copyright (c) Zend Technologies with Zend OPcache v8.2.34, Copyright (c), by Zend Technologies

This is tricky because PHP 8.2.x is supported BUT the only patched version is 8.2.35 so this version is completely vulnerable to PHP2shell.

From the internet using curl

Most sites actually don't provide this but it's worth a shot. You can use this command:

Of course change yoursite.com with your actual website.

curl -I yoursite.com|grep PHP/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 X-Powered-By:PHP/7.4.33

It says PHP/7.4.33 and we know from our chart that PHP 7 is not at all supported so it is vulnerable.

How Can You Fix It?

There is no mitigation, the only solution is for the server to be upgraded to the patched PHP versions in the chart above. If you can't do that then go to the next section "What if You Can't Patch Or Fix It?"

You will need your host or IT administrator or web administrator to update the hosting environment to use a patched version of PHP. A lot of environments are out of date and cannot be updated to a newer version of PHP.

You should get your admin or hire a company that can migrate your website/wordpress/application to a new environment that has a patched PHP version.

In that case our site/database must be migrated to a new host/platform with a new version of PHP.

If you have an updated OS you can usually do this:

apt update

apt upgrade php

What If You Can't Patch Or Fix It?

While waiting for more help, you should take your site offline until you can get a company or administrator to resolve the issue.

This doesn't just mean making your site unavailable, but it means the actual server that runs Apache must be turned off.

If you don't control the full server running Apache behind it or this is a shared host, I recommend backing up all of your data and wiping your files/database clean as that is the only way to guarantee it can't be accessed.

If Apache is still running even if your site is inaccessible, hackers can still gain full access to the server and all sites and data on it, even if the site itself cannot be accessed.

Another method is disconnecting the entire server/VM/environment from the internet but if you don't control the environment this is probably not possible and you should backup your data and wipe everything to prevent it from falling into the hands of hackers.

Issues Migrating To New PHP

You will need an admin or company who is skilled in both hosting and some web development especially if you are migrating a PHP 5 or 7 based application. A lot of PHP 5/7 code will not fully work on PHP 8, which means you need some development assistance if your appication is not just a Wordpress or other premade software.

Who Can Help?

You'll need a skilled hosting company and web development company that can assess if you've been hack and migrate you to a clean and safe environment/platform that is patched against these vulnerabilities.

The type of company you should lean towards is one that has in-house skills and is not just a "web developer" and just a "hosting company" which is where many users are having issues.

You should also choose a company with a proper architecture, the only way to go is to have an isolated VM and containerized environment in Docker and Kubernetes which will allow your host to keep your site updated quickly as the old way of manually patching is too slow and inefficient and is why most sites and companies could not respond fast enough.