PHP2Shell: How we protected our servers before the patch arrived
Two critical PHP vulnerabilities and, for a few hours, no official fix. Here is what we did in that window to keep our clients' websites safe, and what you should check now.
On 21 October 2026, two PHP vulnerabilities became public under the name PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP powers a large share of the web – WordPress, TYPO3, Contao, Joomla and countless custom applications. In the worst case, an attacker can run their own code on an affected server.
The tricky part: there were several hours between disclosure and the official fix. You can't just wait for an update in that window – you have to act.
What we did right away
The attacks go through PHP's session handling. Two settings take away their foothold, and ordinary websites don't notice a thing:
; PHP2Shell interim mitigation – review after updating
session.upload_progress.enabled = 0
session.use_strict_mode = 1
session.upload_progress.enabled = 0turns off upload progress tracking. Hardly any site uses it; uploads themselves keep working.session.use_strict_mode = 1makes PHP accept only session IDs it created itself. That's good practice anyway and can stay on permanently.
We applied both settings to every PHP version on our server, checked them for each client site and reloaded the services. Then we opened every site to make sure nothing had broken.
The actual fix
As soon as fixed releases were out, we updated. As things stand, these versions are safe:
| PHP branch | Fixed version |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Older versions such as PHP 7.x or 8.0/8.1 no longer receive official fixes. If you still run one of them, PHP2Shell is just one more reason to move on.
A quick checklist
- Which PHP version does your site run on? Your host or agency can tell you in a minute.
- Is it patched? Compare it with the table above.
- Still on PHP 7 or 8.0/8.1? Plan an upgrade to a current version – and test before you switch.
- Are your CMS and plugins up to date? A patched PHP doesn't help much if the site itself is years behind.
Large hosts like IONOS rolled out the fix quickly. If you run your own server or an older hosting plan, it's worth asking.
Our takeaway
Good security doesn't mean never being affected. It means knowing quickly which systems are exposed, having a safe interim fix, and then updating cleanly. That's exactly why we monitor the websites we look after.
Not sure whether your site is affected? We're happy to take a look for free – just drop a line to info@berlin-bird.com.