CRITICALPHP2Shell: patch to 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 now
Check my exposure
PHP processes the malicious request before any application code runs, so login pages and application-level controls do not stop it. Patching is the only complete fix. Scan a host you own to see where it stands.
On 21 October 2026 the PHP project released security updates for both flaws. Any PHP script exposes the vulnerable path, even one that only prints a response.
When a memory allocation fails, PHP can abandon a request and leave invalid data for its cleanup routine. Crafted multipart requests (forms and file uploads) can exhaust memory even when they appear to respect configured limits. On Apache mod_php the attack succeeds before application code executes.
A reused PHP worker can access state that still points to memory freed by an earlier request, and fatal errors or timeouts can interrupt cleanup. RCE is confirmed on mod_php and PHP-FPM through the session lifecycle, and on PHP 8.5 through fatal error backtraces.
PHP 5 through 8.5 are affected. The vendor rates Apache mod_php as the highest risk because exploitation can complete before any application code runs.
This includes platforms built on PHP: WordPress, Laravel, Drupal, Magento and most shared hosting.
| Branch | Vulnerable | Update to |
|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
| 7.4 – 8.1 | End of life | Vendor fix or source backport |
| 5.x – 7.3 | End of life | Upgrade to a supported branch |
Treat this as an emergency change, outside normal patch cycles. Tick each step as your team completes it.
Include staging servers, marketing microsites, legacy portals and third-party hosted pages on your domains. You cannot patch what you have not found.
Diras finds them8.2.35 · 8.3.36 · 8.4.27 · 8.5.12, or a distribution package that contains both complete patches. Linux distributions and LTS vendors received patches in advance. Users of rpms.remirepo.net should switch to distribution packages or build from source.
For PHP 7.4, 8.0 and 8.1, use a vendor fix or the limited source backports PHP published for this incident. Anything older must be upgraded to a supported branch.
Restart PHP-FPM pools and Apache so no worker keeps the old binary or old settings in memory. Confirm the version on each host, not just in your package manager.
Limit decoded request size, input and multipart counts, headers per part and nesting depth, including requests without a usable Content-Length. If an application does not use multipart data, block it before it reaches PHP.
Patching closes the door but does not remove an attacker who is already inside.
What to look forTemporary. Reduces exposure to known paths only.
; FPM pool or server config, not ini_set() or .user.ini
php_admin_value[memory_limit] = -1
php_admin_flag[session.upload_progress.enabled] = off
php_admin_flag[fatal_error_backtraces] = off ; PHP 8.5
php_admin_value[post_max_size] = 8M ; 32M if uploads needed
php_admin_value[upload_max_filesize] = 6M
; then restart every worker
The exploit needs no brute force and does not necessarily crash the worker, so there may be no obvious outage.
Multipart POST requests to arbitrary PHP endpoints, including pages that never accept uploads.
Out-of-memory errors raised before application code runs, often in bursts from one source.
php-fpm or httpd spawning sh or bash or curl or wget.
Initial-access brokers list compromised web shells and credentials soon after mass exploitation.
Monitor with DirasContinuous discovery of domains, subdomains, IPs and services, with PHP version fingerprinting, severity and remediation guidance per asset.
Scan my perimeterAlerts on marketplace listings, Breached Employees and Compromised Devices tied to your organization, so you can act before resale turns into ransomware.
Check my exposureAsk “which of my hosts are exposed to PHP2Shell?” and get an answer from your own findings, with cited remediation steps, in Arabic or English.
See a demoThis page summarizes public research. The discovery and the primary technical writeups belong to the researchers and vendors below.
We assess your external attack surface and dark web exposure for two weeks and deliver a report your team can act on, with PHP2Shell findings prioritized.