Black October (PHP2Shell): Am I Affected, How to Check, How to Fix

By Umair Ali Sadaqat · Updated · Editorial policy

On 21 October 2026 the PHP project fixed two critical flaws that let an unauthenticated request run code on a web server. Here is what changed, who is exposed, how to check your server and which versions fix it.

"Black October" is the nickname security people gave to the week of 21 October 2026, when the PHP project shipped emergency releases for two critical bugs now widely called PHP2Shell. Both bugs can let a request from someone who is not logged in run their own code on your web server. Attack traffic started before the fix was even public.

This page is the starting point. It covers what the bugs are, whether your site is exposed, how to check, and what to install. Each platform has its own guide, linked further down.

Short version: if your website runs on PHP, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer in the same line) and restart every PHP process. Nothing else is a complete fix.

What happened

The PHP security team announced on 20 October that a critical release was coming, with both issues rated 9.2 on the CVSS v4.0 scale. The releases went out on 21 October 2026. The official php.net advisory names two bugs:

CVEPlain-English summary
RCE via OOM corruptionCVE-2026-109618 (GHSA-w8hw-w9fx-j79w)When PHP runs out of memory at the wrong moment, a request can be left half set up, and the cleanup step then trusts that broken data.
RCE via stale global stateCVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)Some data that belongs to one request can outlive the memory behind it, and the next request served by the same worker can pick it up before it is reset.

"RCE" means remote code execution: an outsider getting your server to run instructions of their choosing.

According to 404 Media, researchers at Wiz, Calif and OpenAI found the bugs with the help of AI models, and Cloudflare's chief executive said the company saw exploit attempts in the hours before disclosure and millions afterwards. The same report notes that many of the exploit scripts passed around online do not work, and that one researcher judged real-world damage so far to be far below famous incidents like Log4j. Both things can be true: the risk is real, and an unpatched server is the thing that turns it into a problem.

Am I affected?

The advisory says the risk covers every PHP installation that serves web requests. That includes:

  • PHP-FPM (the usual setup behind Nginx, and common on managed hosts)
  • Apache with mod_php, which the PHP team rates as the highest risk, because a demonstrated attack fires before any of your own code runs
  • php-cgi
  • FrankenPHP
  • LiteSpeed (very common on shared hosting)

So the question is not "do I use a risky plugin". It is "does a PHP process answer requests for my site". If your site is WordPress, Joomla, Drupal, Magento, PrestaShop, Laravel, Symfony, a custom PHP app or a cPanel hosting account, the answer is yes.

You are probably not directly exposed if your site is fully static (plain HTML files, or a React, Vue or Astro build served as files) or runs on a hosted platform that does not use PHP. If your host manages PHP for you, you are still exposed until the host updates it.

How to check

Find out which PHP version actually serves your site, not just which one is installed on the command line. They are often different. Our guide to checking your PHP version walks through six ways to do it, from the WordPress dashboard to the server shell.

Then compare against this table:

Your branchSafe fromNotes
PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.358.2 stops getting security fixes on 31 December 2026
PHP 8.1, 8.0, 7.xno official releaseSee what to do on old PHP versions
PHP 8.6 release candidates8.6.0 RC4Test builds only, not for production

Linux distributions often keep the old version number and add their own patch suffix. On Debian, Ubuntu, Red Hat and similar systems, "8.1.2-1ubuntu2.x" can be patched even though the number looks old. Check your distribution's security notice rather than the number alone.

How to fix

  1. Update PHP to a fixed release from your package manager, your host's control panel, or php.net.
  2. Restart every PHP process. PHP-FPM pools, Apache, LiteSpeed and any long-running workers keep the old code in memory until they restart.
  3. Confirm the new version is the one serving pages (repeat the check above).
  4. If you cannot update today, apply the temporary settings in our stopgap mitigation guide. The PHP team is clear that these reduce exposure to specific attack paths and do not make a server safe.
  5. Look for signs of an earlier break-in, because attacks began before the patch. Our compromise check lists what to look at first.

Guides by platform

The fix is always "update PHP", but where PHP lives and who controls it changes with the platform:

After the patch

Two questions come up once the urgent part is done. First, was anything already planted on the server? The compromise check covers that. Second, should a small business keep running its own PHP stack at all? We wrote an honest answer in should you move off PHP, including when staying is the better call.

Sources

Move your site to WeInc

Sites built with WeInc are React code that we host, so there is no PHP server for you to patch. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

More in Blog

Alternatives mentioned in this article

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.

Product

Who It's For

Features

Resources

Company

View Sitemap