PHP2Shell and PHP 8.2 End of Life: A Patch-and-Upgrade Plan for Egyptian Websites and Systems Before 31 December 2026

Quick answer: On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each scored 9.2 out of 10 under CVSS v4.0, that can let an unauthenticated attacker run code on the server. They are widely referred to as PHP2Shell. The only complete fix is to update now. A second deadline follows: security support for the PHP 8.2 branch ends on 31 December 2026, after which it receives no fixes at all, not even for critical flaws.

PHP2Shell is one of the most serious issues to hit PHP in years, because it sits in memory management and error handling, two parts of PHP that almost every request touches. A large share of company websites, online stores, clinic systems and accounting systems in Egypt run on PHP, whether on shared hosting, a VPS or an in-house server. This guide explains what happened using official sources, identifies who is affected, and sets out Smart One Group's three-phase plan: patch within 72 hours, review within 30 days, and upgrade before PHP 8.2 reaches end of life.

What is PHP2Shell and why does it matter for Egyptian websites?

PHP2Shell is the common name for two critical flaws in the PHP engine itself, not in a particular plugin or theme, that allow remote code execution (RCE) without logging in. According to the security advisory on the official PHP website, every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

• CVE-2026-109618 (OOM corruption): out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat that invalid data as valid.
• CVE-2026-109619 (stale global state): internal state owned by one request can survive after its memory has been freed, and a later request handled by the same worker may use it before normal initialization resets it.

The PHP Foundation explains that full remote code execution was demonstrated on Apache with mod_php under default settings, using a single unauthenticated request before any application code runs, and was also confirmed on PHP-FPM through application-level code paths. The PHP team considers mod_php the highest-risk setup.

Why the urgency? The CERT-EU advisory notes that proofs of concept (PoCs) have begun to circulate and advises isolating internet-facing applications where patching is not feasible. Singapore's Cyber Security Agency also reported widespread exploitation attempts on 21 October 2026. The two CVE IDs leaked online on 20 October 2026, which led the project to bring the release forward by a full day.

Who is affected? Patched versions and support dates

The table below lists the patched release for each supported branch and the support dates shown on the official PHP website:

Any version older than the numbers in the second column is affected. The project no longer ships updates for 8.1 and older, although, given the severity, the security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP from source, and some distributions and long-term support vendors may provide backported fixes.

Why 31 December 2026 is a second deadline

Under PHP's supported versions policy, each branch gets two years of full support from its release, then two more years of critical security fixes only, and then reaches end of life. End of life (EOL) means the branch receives no security fix from the PHP project, however severe the vulnerability.

The PHP 8.2.35 announcement itself carried an explicit reminder that the branch reaches end of life on 31 December 2026. In practice, a site patched today to 8.2.35 is protected against PHP2Shell, but it will be unprotected against any flaw discovered after the end of the year. We therefore recommend treating the emergency patch as step one and an upgrade to 8.4 (security-supported until 31 December 2028), or 8.3 at a minimum, as step two.

Smart One Group's three-phase plan

This is a practical plan our team uses for company and clinic websites and systems in Egypt, and it works for shared hosting and private servers alike.

Phase 1: the first 72 hours (patch)

1. Inventory: list every website, system and control panel that runs on PHP, including staging environments, forgotten legacy systems, and off-the-shelf software or appliances that embed PHP.
2. Check the version: use your hosting panel or run php -v on the server, and confirm the version that actually serves web traffic, because it can differ from the command-line version.
3. Prioritize exposure: start with public websites, upload forms and patient or customer portals, then move to internal systems.
4. Update from a trusted source: use your distribution's official packages; the PHP project warned that the volunteer-run rpms.remirepo.net repository would not have the update on release day.
5. Restart every worker: restart PHP-FPM or Apache so the new version is really running, then check the version number again.

Phase 2: within 30 days (verify and harden)

• Review server logs for repeated fatal errors, Maximum execution time exceeded messages or unusual upload requests.
• Inspect exposed sites for unfamiliar files or accounts if they stayed unpatched after exploit code began circulating.
• Disable session.upload_progress if your site does not need it, which the PHP team describes as prudent even after patching.
• Make sure you have a recent, tested backup stored off the server itself.

Phase 3: before 31 December 2026 (upgrade)

• Test the website or system on a staging copy running PHP 8.4, and check compatibility of plugins, libraries and the framework in use.
• Fix deprecation warnings before the move, then migrate production at a low-traffic time with a clear rollback plan.
• Add an annual review of PHP, database and operating system versions to your support contract.

Temporary measures if you cannot update immediately

The PHP project stresses that these measures reduce exposure to specific attack paths but do not make an installation safe; only updating is a complete fix:

• Set memory_limit=-1 in a way the application cannot override, such as php_admin_value in the FPM pool or Apache configuration.
• Lower post_max_size to 8M for applications that do not accept uploads, or 32M if uploads are needed, keeping upload_max_filesize below it.
• Set session.upload_progress.enabled=0 in php.ini or server configuration and restart every worker; do not rely on ini_set() or a .user.ini file.
• On PHP 8.5 only: set fatal_error_backtraces=0 and restart.
• Do not use RLIMIT_AS or RLIMIT_DATA as a substitute memory cap, because they can trigger the vulnerable path.

What to do based on your hosting type

If you still run old Windows servers hosting PHP applications, also read our guide to Windows Server 2016 end of support, because an unsupported operating system undermines any application-level patch. And if you are choosing an outside firm for a security review, our guide to the NTRA register of cybersecurity providers can help.

Frequently asked questions

Is my WordPress site affected by PHP2Shell?

WordPress runs on PHP, so any site on a PHP version older than the patched releases is affected. The flaw is in the PHP engine itself, so updating WordPress or its plugins is not enough; PHP on the server must be updated.

Which PHP version is safe after 21 October 2026?

The minimum is 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. For longer-term planning we recommend the 8.4 branch, which is security-supported until 31 December 2028.

What happens to PHP 8.2 after 31 December 2026?

The branch reaches end of life and receives no security fix from the PHP project, even for critical vulnerabilities. Your site will keep working, but it will stay exposed to any new flaw.

I am on shared hosting. Do I need to do anything?

Yes. Check the PHP version in your control panel, ask your hosting provider in writing whether the update has been applied, and select a supported branch. You may not be able to update the server yourself, but you can ask and keep a record.

Are the temporary measures enough instead of updating?

No. The PHP project says the temporary measures only reduce exposure to specific paths and that updating is the only complete fix. Use them as a bridge for hours or a few days at most.

How do I know whether my site was compromised before patching?

Review server logs, recently modified site files, new admin accounts and scheduled tasks. If anything looks suspicious, take the site offline and bring in an incident response specialist before putting it back online.

How Smart One Group can help

At Smart One Group we provide managed hosting and servers on supported PHP versions, support contracts that cover patching and regular monitoring, as well as website development and custom systems built to be upgraded without long downtime. If you are not sure which PHP version your website or system runs, contact us for a quick review and an upgrade plan before 31 December 2026.