CVE-2026-109618 · CVE-2026-109619php2shell: is your PHP affected?

npx wardlatch@latest --incident php-2026-10

It looks for programs called php, php-fpm and php-cgi, and versioned ones such as php8.1, php-fpm8.1 and php-cgi8.3, on your PATH, in the sbin folders, and in Homebrew’s php@*, Remi’s, cPanel’s and Plesk’s install folders. It runs each one with -n -v, which prints the version without reading php.ini, and compares that with the fix for its line; a later copy of a name that is a script isn’t run (section D). Each line of the result says EXPOSED (with the fix under it), SAFE, or UNKNOWN when it couldn’t look, and a REVIEW line names any copy it didn’t run; in a folder it can enter but not list, it finds only php itself, without a word (section D). It changes nothing and sends nothing.

By hand: this prints the version of the PHP your shell runs.

php -n -v

On a Linux server, this lists the other PHP programs in the usual system folders, with where each one is:

find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -maxdepth 1 -name 'php*' 2>/dev/null | grep -E '/php(-fpm|-cgi)?[0-9.]*$'

Run each path it prints with -n -v, for example /usr/sbin/php-fpm8.3 -n -v. On a Mac with Homebrew, brew list --versions | grep -E '^php(@[0-9.]+)? ' lists the PHP versions Homebrew installed. Remi, cPanel and Plesk keep their PHP versions in their own folders, which Wardlatch searches; their control panels list them too.

Fixed

8.5.12 or later on 8.5, 8.4.27 or later on 8.4, 8.3.36 or later on 8.3, 8.2.35 or later on 8.2.

Update

An earlier version on the 8.2, 8.3, 8.4 or 8.5 line.

No fix

8.1 or older: the PHP project no longer updates these lines. See section C.

Distribution

A Linux distribution’s package can carry the fix under its old version number: PHP gave the patches to distributions and long-term support vendors in advance. If your PHP came from your distribution, check its security page for CVE-2026-109618 and CVE-2026-109619.

A website you don’t run yourself: the header check on the Wardlatch page shows whether a site says which PHP it runs. Many sites hide it, so ask your developer or host.

• PHP 8.2 reaches end of life on 2026-12-31 and will get no security fixes after that, PHP says: plan a move to a newer line.
• PHP 8.1 and older no longer get updates from the PHP project. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1, for people who build PHP themselves; otherwise use your distribution’s or long-term support vendor’s fixed package, or move to a supported line.
• Linux distributions received the patches in advance, PHP says. Their fixed packages may keep an older version number, so go by the distribution’s own page for the two CVEs.

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later on the same line, the way you installed it: your distribution’s package manager, Homebrew, Remi, or your control panel.
2. Restart PHP-FPM, Apache or your PHP server. A running server keeps the old PHP loaded until it restarts.
3. On 8.1 or older, use your distribution’s or long-term support vendor’s backport, the PHP project’s source backports if you build PHP yourself, or move to a supported line.
4. On shared hosting, ask your host which PHP your site runs and when it gets the fix.
5. Can’t update today? PHP’s advisory lists settings that reduce exposure to some attack paths, and says they do not make an installation safe. Update as soon as you can.
6. Check again with the commands in section A.

• Version numbers only. Wardlatch judges the version a PHP prints. A distribution’s package that carries the fix under an older number still reads EXPOSED: check it against your distribution’s page.
• Programs by these names only. PHP built into another program, such as Apache’s mod_php module, FrankenPHP or LiteSpeed’s PHP, is not a program called php, php-fpm or php-cgi, and isn’t checked. Check those with your package manager or control panel.
• This machine only. PHP inside containers, on other servers and at your host isn’t checked.
• Copies it doesn’t run. It runs the first copy of each name, looking on your PATH first, as your shell does, and every later copy that is a compiled program; a later copy that is a script is named in a REVIEW line and not run.
• Folders it can’t list. In a folder it can enter but not list, Wardlatch finds only a program called php, not php-fpm, php-cgi or a versioned one such as php8.1, and says nothing about them: run it as an account that can list the folder.
• macOS and Linux. Windows is not supported yet.

This page describes Wardlatch 0.1.9 and its incident file, php-2026-10.json.

1. PHP, security advisory: critical remote code execution vulnerabilities, update now, 2026-10-21: every PHP installation serving web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed); fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; minimal source backports for 7.4, 8.0 and 8.1; patches given to distributions and long-term support vendors in advance; 8.1 and older no longer updated.
2. PHP’s release notes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35, 2026-10-21: no complete mitigations, updating is the only safe choice; 8.2 reaches end of life on 2026-12-31.
3. PHP’s advisories on GitHub, GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), 2026-10-21: critical, CVSS 4.0 score 9.2; affected before 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
4. Qualys, PHP announces critical security release for two vulnerabilities, 2026-10-20 (the report Wardlatch’s incident file cites): a distribution’s backported fix may keep an older upstream version number.
5. Wardlatch 0.1.9, php-2026-10.json and README: what the check looks at.

Credits · PHP’s advisories credit lcfr-hax, sagitzadik-wiz, tomash-areion and amyb-oai with reporting both flaws, and arnaud-lb, iluuu1994, bukka and ndossche with the fix. All sources read 2026-10-25.