What Is PHP2Shell, and Are You Affected?

On October 21, 2026, the PHP project released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Patching is the easy part. The hard part, for most organizations, is answering the first question of the day: where is PHP running in our software, and which versions are in use?

Written by Junsu Lee, Director of Pre-Sales, Insignary 5 min read

What is PHP2Shell?

On October 21, 2026, the PHP project disclosed and released fixes for two critical vulnerabilities in the PHP runtime. “PHP2Shell”, CVE-2026-109618 and CVE-2026-109619, are vulnerabilities that can allow unauthenticated remote code execution. Upgrading is the only complete fix.

Source: php.net release announcements, October 21, 2026.

Why this one is hard to scope

A flaw in your own code shows up in your own repository. A flaw in a runtime does not. PHP is found inside things such as a content management system, an internal tool, a vendor's web console, a network appliance, and the base layer of a container image. Each of them pins its own version, and most of them do not tell you which one.

That leaves security teams with three slow options in responding: they can run vulnerability management scanners across their entire infrastructure to identify installations, run php -v on every server to check for vulnerable instances, or wait for suppliers to confirm whether their products contain affected versions. Each approach has limitations. Without an accurate inventory of the software running across their environment, organizations will struggle to identify affected systems and prioritize remediation.

What we found in public images

On October 23, 2026, we examined two builds of the official wordpress:7.1.3-php8.3-apache image: the build published on October 7 and the one published on October 21. We also checked a stock Ubuntu 24.04 install of PHP 8.3. The check was static; it did not start containers, execute PHP, or generate network traffic. The results are shown below.

Checked October 23, 2026. WordPress image digests: sha256:8ecd8d8e…7be251f (Oct 7) and sha256:d42f63cb…52b1a20b (Oct 21). The Ubuntu changelog entry for 8.3.6-0ubuntu0.24.04.13 (noble-security) lists CVE-2026-109618_109619.patch.

Two things stand out. First, one WordPress container includes PHP in two places: the command-line binary and the Apache module that serves web requests, which is the kind of installation the PHP project lists as at risk. Simply running php -v would identify the first but may miss the second.

Second, the patched Ubuntu build still reports PHP 8.3.6, far below the fixed version of 8.3.36. A check that compares version numbers alone, including one that reads the version from a web server's response header, would report this server as vulnerable. Only the package build shows the fix, so an inventory has to record the package build as well as the version.

How Insignary Clarity helps answer "Are we affected?"

Find the runtime without the source

Insignary Clarity's patented binary SCA builds an SBOM from compiled code: applications, embedded firmware, IT infrastructure, and containers. That covers the software you buy as well as the software you build, so the PHP runtime inside a vendor's product, and its version, can be identified without waiting for the vendor to tell you.

Keep every SBOM in one place

Insignary Clarity SC brings results from Insignary Clarity, Clarity AIR, third-party SCA tools and imported SPDX or CycloneDX SBOMs into one platform. Different teams can keep their own scanners and still answer one question across the organization: which systems are vulnerable?

Get alerts without rescanning

Clarity SC synchronizes CVE data daily and emails project owners when a new CVE affects a component in their SBOMs. When new CVEs are disclosed, Clarity automatically maps them to all existing SBOMs without requiring teams to rescan their systems and projects.

Validate suppliers' claims

Clarity can generate an SBOM from a vendor’s binary – without decompiling code or violating license agreements. When a supplier says it has patched its software, Clarity SC can validate the supplier's SBOM against the delivered binary.

Three key takeaways

Common questions

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, all released on October 21, 2026. The PHP project says upgrading is the only complete fix.

Is my application affected if its own code is clean?

It can be. The flaws are in the PHP runtime, so an application served by an unpatched PHP version can be exposed regardless of the security of its own code. The PHP project lists installations serving web requests as at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

How do I find PHP inside software I did not build?

Use binary software composition analysis, which identifies open source components and their versions from compiled code, firmware and container images without the source code.

Does an SBOM stop the attack?

No. An SBOM tells you where a vulnerable component is. Stopping the attack still means upgrading or isolating the affected service.

Sources