In the third week of October 2026, two critical vulnerabilities in the PHP core were disclosed, known together as PHP2Shell. They let an attacker run arbitrary code without a username or password on any server where PHP serves web pages. WordPress sites, online shops, admin panels and the web interface of the Issabel phone system are all at risk.
This article explains which versions are affected, how to find your own PHP version, and exactly what to do for Issabel and for websites.
What is PHP2Shell?
- CVE-2026-109618: remote code execution through data corruption when memory runs out.
- CVE-2026-109619: remote code execution through internal state of one request surviving into the next.
Both are rated 9.2 out of 10 on CVSS v4.0. According to the PHP advisory, every installation that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP. The risk is highest for Apache with mod_php, where an attack can succeed before the application’s own code runs.
Details leaked on 20 October, a day before the patches, and security companies including watchTowr and Sophos have reported real exploitation attempts. This is not a theoretical risk.
Which versions are affected?
The fixed releases came out on 21 October 2026:
- PHP 8.5: 8.5.12 and later
- PHP 8.4: 8.4.27 and later
- PHP 8.3: 8.3.36 and later
- PHP 8.2: 8.2.35 and later
- PHP 7.4, 8.0 and 8.1: no longer officially supported and no new official release. Only minimal source backports from the PHP project, or patched packages from Linux distributions and long-term support vendors.
- PHP 7.3 and older, including 5.x: affected, with no official fix. The right move is a supported branch.
Important: updating WordPress, plugins or the application does not fix this. PHP itself must be updated. Configuration changes, in PHP’s own words, “reduce exposure but do not make an installation safe”.
Step 1: find the PHP version that really serves your site
On the server:
php -vThe command-line version can differ from the one serving the site, so check these too:
php-fpm -v
httpd -M 2>/dev/null | grep -i php
apache2ctl -M 2>/dev/null | grep -i phpIf the last two show php_module or php7_module, PHP runs as mod_php inside Apache, the highest-risk setup.
Note: Linux distributions (Ubuntu, Debian, Rocky) usually apply the fix to their own version number, so the version may still read, say, 8.3.6 while the package is already patched. To be sure, search the package changelog for the CVE numbers (examples below).
Issabel: what to do
Issabel’s web panel runs on Apache and PHP. If that panel is reachable from the internet, an attacker can take over the phone system through this bug, and a compromised phone system means fraudulent international calls at your expense.
Issabel 4 (on CentOS 7)
Issabel 4 runs PHP 5.4, and CentOS 7 has been unsupported since June 2024. There is no official fix for this version. In order of importance:
- Today, close the web panel (ports 80 and 443) to the internet and allow only the internal network and VPN.
- Apply the mitigation settings below.
- Plan a migration to Issabel 5 on Rocky Linux 8.
Issabel 5 (on Rocky Linux 8)
Check the PHP version and installed packages:
php -v
rpm -qa 'php*'Check for and install updates:
dnf check-update 'php*'
dnf update 'php*'Check whether the installed package carries the PHP2Shell fix:
rpm -q --changelog php | grep -i -E "109618|109619"If the output is empty, a patched package for your PHP branch is not yet in your current repositories. In that case, as with Issabel 4, close the panel to the internet and apply the mitigations. Do not use unknown scripts that “upgrade Issabel’s PHP” without a backup and testing; changing the PHP version can break parts of the panel.
After any change, restart Apache:
systemctl restart httpdClosing the Issabel panel to the internet
This is the simplest and most effective step. If Issabel sits behind a MikroTik router and only the SIP trunk needs to come from outside, allow web access only from a list of admin addresses:
/ip firewall address-list add list=admins address=192.168.1.0/24
/ip firewall filter add chain=forward dst-address=192.168.1.10 protocol=tcp dst-port=80,443 src-address-list=!admins action=drop comment="Issabel web: admins only"Replace the addresses with your own network and Issabel address, and place the rule above any accept rules. For access from outside the office, use a VPN.
Mitigations when you cannot update yet
The PHP advisory suggests these settings, stressing that they reduce exposure but are not a substitute for updating. In php.ini (on Issabel usually /etc/php.ini) or in the PHP-FPM pool settings:
session.upload_progress.enabled = 0
post_max_size = 8Msession.upload_progress.enabled = 0closes the known path for CVE-2026-109619. It must be set inphp.inior the server configuration, not withini_set()in code.- Lower
post_max_size: 8 MB if you do not upload large files through the panel, around 32 MB if you upload audio files or backups. - For CVE-2026-109618 the advisory also recommends a
memory_limitsetting; read the full advisory before changing it, because it affects how applications behave.
After changing settings, every PHP process must be restarted (Apache or PHP-FPM). As long as old processes are running, the new setting does not apply.
PHP websites: shared hosting, VPS and Docker
Shared hosting (cPanel, DirectAdmin)
- In Select PHP Version or MultiPHP Manager, move the site to a supported branch (8.2 to 8.5).
- Ask your hosting company whether the patched packages are installed. On shared hosting, updating PHP itself is the host’s job.
- Back up the site before changing versions. Old plugins and themes may not work with PHP 8.
Ubuntu and Debian servers
sudo apt update
sudo apt list --upgradable | grep -i php
sudo apt upgradeThen restart the PHP service and the web server, for example:
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2Rocky, AlmaLinux and RHEL servers
sudo dnf update 'php*'
sudo systemctl restart php-fpm httpdDocker
The official PHP images have been rebuilt with the fixed versions. Pull the image again, rebuild the container and make sure the version is at least one of the fixed releases above; if you pinned a version in your Dockerfile, change it.
After updating: check that nobody got in
Since exploitation was reported even before the patch, updating is not enough; check that nothing was left behind:
- New or unknown PHP files in site folders, especially upload folders:
find /var/www -name "*.php" -newermt "2026-10-15" -ls- New system users, unknown cron jobs and unusual outbound connections.
- On Issabel: new trunks and outbound routes, unknown extensions and unusual international calls in the call records. Also change the panel admin password and the SIP passwords.
If you find signs of compromise, deleting a few files is not enough. Rebuild the server from a clean backup or a fresh install and change every password.
One more item: CVE-2026-115560
On 23 October PHP announced another, unlikely attack path. It only affects applications that change the session serializer while running. PHP’s advice is the same session.upload_progress.enabled = 0 setting until the next regular release. If you have already set it, nothing else is needed.
Summary
- Find the real PHP version of your site and of Issabel.
- Update to a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later) or your distribution’s patched package.
- If you cannot, close panels to the internet and apply the mitigations.
- Restart every PHP process.
- Check for signs of compromise.
If your Issabel or website server runs an old PHP version and you are not sure where to start, request a review from VoIP and business communications or network security and firewall. To restrict access on MikroTik, see network security with MikroTik.
Sources: PHP security announcements, watchTowr’s PHP2Shell FAQ, Datadog Security Labs analysis, FreePBX community thread on PHP patching.
Photo: lmonk72, public domain (CC0), via Wikimedia Commons; cropped.
