What is php2shell?
php2shell is the name given to two flaws in PHP itself, disclosed on October 21, 2026. They do not depend on your CMS, your plugins or your code: any site running an unpatched PHP is exposed.
- CVE-2026-109618: PHP runs out of memory while it reads a crafted upload and stops halfway, leaving the request half set up.
- CVE-2026-109619: What that crash leaves behind survives into the next request, for instance through the upload progress feature of PHP sessions.
Chained together, they let an attacker run code on your server. Exploitation started within hours of the disclosure.
A related flaw in session upload progress
Two days later, PHP published an informational advisory on the same upload progress feature:
- CVE-2026-115560: An application that switches the session serializer to php at runtime lets a crafted upload progress entry inject session data.
Only applications that change the session serializer at runtime are exposed, and no PHP release fixes it yet. Until one does, PHP recommends turning session.upload_progress.enabled off.
Update PHP first
Only a PHP update fixes php2shell: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or the patched package of your Linux distribution or of your host. Debian, Ubuntu and most hosting panels ship the fix without changing the version number, so check the changelog of your package, or ask your host. Each advisory above lists the fixed versions.
A web firewall does not replace this update, ours included. What it can do is make the attack much harder to complete while you patch.
How the CDN Exploit Shield helps
When your site sits behind the CloudFilt CDN, every upload goes through us, and so does the answer of your server. The Exploit Shield watches that exchange:
- an upload that makes your server answer with an error 500 is the trace of the first php2shell step: twice from the same visitor within 10 minutes, and in Block mode that visitor is banned for 24 hours on all our servers, with no captcha to lift it;
- an upload carrying the PHP upload progress field is the second step: after any crash it is paused for 10 minutes, whoever sends it, so switching IP does not finish the attack;
- a “|” in a field name or in the upload progress value is how session data gets injected: in Block mode that upload is refused and its sender banned at once. A “|” in a file name, which macOS and Linux allow, only gets the upload refused.
Uploads that work stay untouched, and the upload progress field is only paused right after a crash: sites that use it for their progress bars lose them for those few minutes. When your server fails for many visitors at once, a crash under load or a maintenance, the shield raises its ban threshold instead of banning your customers.
Start in Observe mode: the shield lists what it would have banned and blocks no one. Switch to Block once you trust what you see.
What it does not do
- The first malicious upload still reaches your server. The shield breaks the chain, it does not make PHP safe.
- A server set to display PHP errors answers a crash with a normal page instead of an error 500: the shield cannot see that crash.
- Traffic sent to your server directly, without going through the CDN, is not inspected.
- It only applies to sites behind the CloudFilt CDN, not to sites protected by our plugins or code snippets alone.
Turn it on
Put your site behind the CloudFilt CDN / WAF, then open Settings, Protection, Exploit Shield, and choose Observe or Block. The panel lists the latest events, and the full list is one click away.