PHP2Shell: update PHP on your server now (CVE-2026-109618 and CVE-2026-109619)

Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"), were fixed by php.net on 21 October 2026. An attacker with no login can run code on the server with a single HTTP POST to any PHP page. Every PHP version from 5.4 to 8.5 is affected, and attacks in the wild have been reported since 17 October, with exploit code public.

Are you affected?

If a server of yours runs PHP (WordPress, Laravel, a control panel or your own scripts), yes. Run php -v to see the version.

What to do

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later, or install your distribution's patched PHP package. AlmaLinux has backported the fix to older streams.
2. Restart PHP-FPM or your web server so the new version is loaded.
3. Run php -v again, and check the web server's PHP as well if it differs from the command-line one.

PHP 8.1 and older have no fix from php.net. Use your distribution's patched package if it offers one, or move to PHP 8.2.35 or later.

If you cannot update today

Set session.upload_progress.enabled = 0 in php.ini and restart PHP-FPM or the web server. This reduces your exposure, but it is not a complete fix, so still update.

Signs of compromise

• PHP files you did not create
• cron jobs or user accounts you did not add
• web server processes starting shells

If you find any of these, treat the server as compromised: rotate your passwords and keys, and restore from a backup you trust.

What we have done

AFRICLOUD's own infrastructure that runs PHP has been patched, and we found no evidence of compromise. Your server is self-managed. You have full root access and complete control over what runs on it. Our support covers our network, our hardware and the platform itself. As a matter of policy we do not log in to customer servers, so software and configuration inside the server stay under your control.