--- title: "Critical php2shell vulnerabilities: What you need to know" description: Learn what the critical php2shell vulnerabilities mean, how Acronis is responding and the steps to patch PHP servers and check for compromise. canonical_url: https://www.acronis.com/en/blog/posts/critical-php2shell-vulnerabilities-what-you-need-to-know/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Critical php2shell vulnerabilities: What you need to know Learn what the critical php2shell vulnerabilities mean, how Acronis is responding and the steps to patch PHP servers and check for compromise. [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 3 min read Last updated 22 October 2026 Other languages available:[日本語](https://www.acronis.com/ja/blog/posts/critical-php2shell-vulnerabilities-what-you-need-to-know/) On October 21, 2026, the PHP project published fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and collectively known as php2shell. Since then, we have received questions about what to do. ## PHP flaws explained The flaws are in the PHP engine. A WordPress, Drupal, Magento or Laravel site is exposed even if every plugin and theme is current, because updating the application does nothing to the engine underneath. An attacker with no account can execute code on the server or read data from its memory. Fixes appeared at 14:00 UTC on October 21; details reportedly leaked the day before. The Acronis Threat Research Unit (TRU) reports that several vendors observed exploit attempts beginning October 17, with activity increasing after the leak. As of October 22, no successful compromise has been publicly confirmed, and CISA has not added the CVEs to its Known Exploited Vulnerabilities catalog. That status may change. Two earlier PHP vulnerabilities, CVE-2024-4577 and CVE-2019-11043, were later associated with ransomware campaigns. ## Acronis status Acronis Cyber Protect does not use PHP, so there is nothing for customers or partners to patch. A small number of Acronis web properties do run on PHP. We took those offline the moment the fixes were published, before patching, which is the safe order when exploit attempts are already in the wild. Our engineers ported both applications to PHP 8.5 and brought them back the same day. The community forum was updated by its external vendor and is back online as well. ## What to do on your own servers If you host PHP — on client websites, cPanel or Plesk servers, ticketing or billing portals, appliances that bundle PHP, or Windows servers running PHP under IIS, XAMPP or WAMP — take action. TRU recommends the following order: 1. Inventory every copy of PHP, including containers and third-party software that bundles it. Most people are surprised by what they find. 2. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution’s fixed package. Distributions often keep the old version number after backporting a fix, so check the package changelog for the CVE IDs rather than trusting php -v. 3. Fully restart every PHP process afterwards: Apache, PHP-FPM, IIS application pools. Rebuild container images. A running process keeps the old code until it is restarted, and updating the website or its plugins changes nothing. 4. PHP 8.1 and older have no official upstream releases. Use a vendor-provided fix where available or upgrade. For PHP 7.3 and older, restrict internet access until you can upgrade. 5. If you cannot update today, consider a web application firewall with php2shell-specific rules and the proposed interim PHP settings (session.upload_progress.enabled=0, memory_limit=-1 at the server level with a container memory limit, a low post_max_size and fatal_error_backtraces=0 on 8.5), followed by a restart. These measures may reduce exposure but do not replace patching. Do not download “proof-of-concept” exploits to test your own servers. Some are fake, and some carry malware. ## Check for compromise as well as exposure Exploit attempts started around October 17, four days before the fix, so a server that was patched on October 21 may already have a visitor. Look at internet-facing PHP servers for activity from October 17 onward: * Web server processes (apache2, httpd, php-fpm, php-cgi, or w3wp.exe and php-cgi.exe on Windows) launching shells or tools such as curl, wget, cmd.exe or powershell.exe. * New or changed .php files in web directories. * New cron jobs, scheduled tasks or user accounts. * PHP error logs showing memory exhausted “in Unknown on line 0”, or bursts of segmentation faults. * Web logs with multipart POST requests containing PHP_SESSION_UPLOAD_PROGRESS, or user agents starting with php2shell-. One variant of the attack leaks server memory and leaves almost nothing in the logs. If a server ran unpatched Apache mod_php on the internet, rotate the credentials it held in memory: database passwords, API keys — anything in configuration files. ## Acronis MDR response [Acronis MDR](https://www.acronis.com/en/platform/mdr/) detection rules have been updated for this attack and related PHP vulnerabilities, and TRU is running a threat hunt across MDR customers and will raise findings as top priority. Consider Acronis MDR to help your team investigate and respond to this and future security incidents. [MSP cybersecurity](https://www.acronis.com/en/blog/tags/msp-cybersecurity/) [Vulnerability management](https://www.acronis.com/en/blog/tags/vulnerability-management/) ## Written by ![Image 3: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-cloud-is-now-acronis-cyber-platform/) [Acronis Cyber Protect Cloud is now Acronis Cyber Platform](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-cloud-is-now-acronis-cyber-platform/) [Next post](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis Cyber Protect Cloud is now Acronis Cyber Platform](https://staticfiles.acronis.com/images/blog-card/1e0e5c2a4d7ac8dcb164b4b2a9706b82.png) [Acronis Cyber Protect Cloud is now Acronis Cyber Platform](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-cloud-is-now-acronis-cyber-platform/) Service providers have known Cyber Platform as Acronis Cyber Protect Cloud, whereas corporate customers have known Cyber Platform as Acronis Cyber Protect. To simplify partner, customer and user experience, Acronis offerings for both service providers and end-customers are renamed to Acronis Cyber Platform. **October 21, 2026**3 min read ![Image 6: Acronis Accelerate: Missed it? Now is your time to act](https://staticfiles.acronis.com/images/blog-card/41a9e5d6e84178ff5430708ea4063701.png) [Acronis Accelerate: Missed it? Now is your time to act](https://www.acronis.com/en/blog/posts/acronis-accelerate-missed-it-now-is-your-time-to-act/) Missed Acronis Accelerate: Time to act? Watch how AI and automation can transform the MSP workday with automated client onboarding, 24/7 MDR and Cyber Frame. **October 16, 2026**5 min read