What is php2shell?
php2shell is the name given to two flaws in PHP itself, disclosed on October 21, 2026. They do not depend on your CMS, your plugins or your code: any site running an unpatched PHP is exposed.
- CVE-2026-109618: PHP runs out of memory while it reads a crafted upload and stops halfway, leaving the request half set up.
- CVE-2026-109619: What that crash leaves behind survives into the next request, for instance through the upload progress feature of PHP sessions.
Chained together, they let an attacker run code on your server. Exploitation started within hours of the disclosure.
Update PHP first
Only a PHP update fixes php2shell: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or the patched package of your Linux distribution or of your host. Debian, Ubuntu and most hosting panels ship the fix without changing the version number, so check the changelog of your package, or ask your host. Each advisory above lists the fixed versions.
A web firewall does not replace this update, ours included. What it can do is make the attack much harder to complete while you patch.
How the CDN Exploit Shield helps
When your site sits behind the CloudFilt CDN, every upload goes through us, and so does the answer of your server. The Exploit Shield watches that exchange:
- an upload that makes your server answer with an error 500, twice from the same visitor within ten minutes, is the trace of the first php2shell step;
- an upload carrying the PHP upload progress field right after such a crash is the second step;
- either way, in Block mode, the visitor is banned for 24 hours on all our servers before the next request reaches your site.
Uploads that work stay untouched, and the upload progress field on its own is never blocked: sites that use it for their progress bars keep working. When your server fails for many visitors at once, a crash under load or a maintenance, the shield raises its threshold instead of banning your customers.
Start in Observe mode: the shield lists what it would have banned and blocks no one. Switch to Block once you trust what you see.
What it does not do
- The first malicious upload still reaches your server. The shield breaks the chain, it does not make PHP safe.
- A server set to display PHP errors answers a crash with a normal page instead of an error 500: the shield cannot see that crash.
- Traffic sent to your server directly, without going through the CDN, is not inspected.
- It only applies to sites behind the CloudFilt CDN, not to sites protected by our plugins or code snippets alone.
Turn it on
Put your site behind the CloudFilt CDN WAF, then open Settings, Protection, Exploit shield, and choose Observe or Block. The panel lists the latest events, and the full list is one click away.