First aid for security vulnerabilities · now: PHP2Shell
PHP2Shell: First Aid for Your PHP Website
Two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow code execution on web servers without a login. Here is how to check whether you are affected and what helps until the update. Or we take care of it for you.
Free guide
1Am I affected?
Every PHP version below the releases listed here is affected, according to current analyses back to PHP 5.4. It does not matter whether PHP runs via PHP-FPM, mod_php, CGI or LiteSpeed.
On shared hosting you find the version in your host's control panel under the PHP settings. On your own server, php -v only shows the command line. What counts is the version the web server uses to run PHP.
Count everything that runs PHP: website, shop and customer portal, but also forgotten files such as the host's placeholder page, old copies of the site and admin tools. On shared hosting all domains of an account often run under the same user.
| PHP branch | Safe from |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 (security support ends 31 Dec 2026) |
| 8.1 and older | no official update, ask your host or Linux distribution |
2Immediate measure until the update
As far as is known, every attack path runs through multipart/form-data requests. PHP parses them before your application starts, so maintenance mode and security plugins do not help. If your website needs no file uploads, the web server can reject such requests:
Apache and LiteSpeed (.htaccess in the web root, at the very top)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP:Content-Type} multipart/form-data [NC]
RewriteRule ^ - [F,L]
</IfModule>nginx (in every server block that passes requests to PHP)
if ($http_content_type ~* "multipart/form-data") {
return 403;
}This also blocks file uploads, such as product images in a shop back end or forms with attachments. Test login, checkout and forms afterwards. If you need uploads, limit the rule to the paths without uploads or take the site offline until the update. According to a PHP core developer, disabling session upload progress alone is not enough.
3After the update
- Check the version through the web server, not the command line.
- Rotate the secrets PHP loads: database password, API keys for payment and mail providers, session and token secrets. CVE-2026-109618 can leak memory even without code execution.
- Look for unknown PHP files, especially in upload folders, plus changed .htaccess files, new cron jobs and new admin accounts.
- Only remove the block from step 2 if you need uploads.
4Check reporting duties
- GDPR: if personal data may have leaked, check whether to notify the data protection authority within 72 hours (Art. 33).
- NIS2: if your company is in scope and there was a significant incident, an early warning is due within 24 hours.
- Cyber Resilience Act: manufacturers shipping PHP in devices or software must report actively exploited vulnerabilities within 24 hours (Art. 14).
We take care of it
Two fixed-price packages, for businesses only. Reply within 24 hours, usually on the same working day. Invoice after completion.
Security authorities advise taking systems offline that cannot be updated right away. For a shop that means no orders until the host catches up. With the immediate measure your website stays reachable in most cases, and the known attack paths are still closed. If the site needs uploads, we block only the paths without uploads and tell you openly what risk remains.
- External check: PHP version, reachable PHP files, protection in place or not
- Inventory of all PHP files in your hosting account
- Apply and test the immediate measure (login, checkout, forms)
- Hide the server's version information
- Short report with the list of credentials to rotate
- Follow-up check once your host has applied the update
- Everything in the quick check
- Search for traces: unknown and changed files, cron jobs, new admin accounts, unusual requests in the logs
- Preservation of traces for a later investigation
- Plan for rotating all credentials
- Assessment of reporting duties under GDPR, NIS2 and the CRA with draft notifications
What we do not offer: a forensic investigation. If we find signs of a breach, we say so clearly and recommend the next steps.
How it works
- 01Authorisation
You fill in the form and send the authorisation from your company address.
- 02External check
No access needed, usually within a few hours. Often this already shows whether you are affected.
- 03Access
Ideally a separate FTP or SFTP account just for us, limited to the web folder. If that is too technical, we work with the login to your hosting account and change settings such as the PHP version ourselves. You change the password afterwards.
- 04Measure and test
We only change what was agreed and document every change, including how to undo it.
- 05Report
What we found and changed, what is still open and which credentials you should rotate.
- 06Access back
You delete the extra account and change shared passwords. We keep no credentials.
Order and authorisation
Nothing is stored on our server. The form creates an e-mail that you send to us from your company address. It serves as written authorisation. If you prefer to sign, use the print version.
Never put passwords in this e-mail. After our confirmation, send them via Signal or WhatsApp to +43 690 10 44 0002 (end-to-end encrypted) or via a self-destructing link.
Still missing: Company, Your name, E-mail (company address), Domains and servers, I am authorised to …, I allow the external …, I allow changes to …, I commission SECINTS e.U. …
If no mail program opens, copy the text and send it to office@secints.com.
Terms of engagement and data processing
as of 22 October 2026
Frequently asked
This page reflects the status as of 22 October 2026 and is for information only. It does not replace an individual assessment or legal advice.