Advisory: PHP2Shell Vulnerability

Summary

On October 21, 2026, PHP released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These vulnerabilities can allow unauthenticated attackers to execute code on affected services or read sensitive information from PHP worker memory, including passwords, tokens, and API keys.

These vulnerabilities affect PHP itself, including PHP-FPM (FastCGI Process Manager). Applications using frameworks and platforms such as Laravel, WordPress, Drupal, and Joomla can be affected. See the PHP security advisory and Wiz Research's disclosure for details.

Update and redeploy your PHP services as soon as possible. All PHP services on Render use Docker, which means you update the PHP installation in your Docker image to patch these vulnerabilities.

Steps to secure your services

1. Update PHP in your Docker image

Update to the patched version for your PHP branch, or a later release in that branch:

• If your base image includes PHP, update your Dockerfile's FROM instruction to use an image containing a patched PHP release. Keep the image variant your application requires, such as FPM or Apache.
• If your Dockerfile installs PHP from distribution packages, install the fixed packages identified in your distribution's security advisory. Distributions might backport the fixes while retaining an older upstream version number.
• If your service pulls a prebuilt image from a registry, build or obtain an updated image containing patched PHP and push it to the registry. Update your service's image tag or digest if necessary.

PHP 8.1 and earlier are outside regular upstream support.

Upgrade to a supported branch or obtain a fixed build from your distribution or support vendor. PHP has also provided limited source backports for 7.4, 8.0, and 8.1. For details, see the PHP advisory.

2. Redeploy your PHP services

Deploy your updated code or image to every affected Render service. From a Git-backed service's page in the Render Dashboard, select Manual Deploy > Deploy latest commit. For a service that pulls a prebuilt image, trigger a deploy of the updated image. Wait for each deploy to complete successfully.

3. Confirm the deployed PHP version

Check the PHP version in your deployed service's shell:

Also check that the PHP version handling your app's web requests is patched. If you use PHP-FPM, check its version too.

History of updates to this advisory