PHP2Shell Workarounds for PHP 8.1 and Older

PHP 8.1 and older received no official PHP2Shell releases on 21 October 2026. A vendor backport can fix CVE-2026-109618 and CVE-2026-109619 without changing the PHP version number; temporary settings cannot. If your provider cannot identify the fixed package build, restrict the exposed service today and start a supported-version migration.⁠¹⁠²

The PHP2Shell and Node2Shell guide covers the wider incident. Here the problem is a runtime you cannot yet replace.

Old PHP needs a documented backport

The PHP Support Lifecycle ends with End of Life (EOL), when the project stops supplying releases. PHP 8.1 and older reached that point before PHP2Shell. A hosting company’s Extended Security Support or Long-Term Support (LTS) contract may supply fixes independently; the contract alone does not prove this particular fix is installed. PHP published minimal source backports for 7.4, 8.0 and 8.1, not normal upstream releases for those branches.⁠¹⁠³

Reported Plesk lists fixed Linux builds of PHP 7.4.33, 8.0.30 and 8.1.34 dated 21 October 2026. The version strings did not change. cPanel’s EasyApache change log separately records backports for ea-php74, ea-php80 and ea-php81. Ask for your exact package release, its vendor advisory and the applied update; php -v is not a complete patch check.⁠²⁠⁴ How to verify your host’s PHP2Shell patch explains what to request.

The failure is inside PHP. CVE-2026-109618 involves memory corruption during Out-of-Memory (OOM) handling: memory exhaustion can interrupt request setup, leaving partially initialized data for cleanup to mishandle. An underlying memory allocation failure can reach that path too. CVE-2026-109619 instead involves stale internal state surviving between requests handled by a worker. Both can permit remote code execution under affected conditions.⁠¹⁠⁵

Temporary mitigations close only specific paths

A Temporary Security Mitigation narrows a confirmed exploit path; it does not repair the code. PHP explicitly says only updating is a complete remedy. Apply the relevant setting at a level that takes effect before request parsing, then restart every PHP worker.⁠¹

Removing the PHP memory cap increases the risk of resource exhaustion. If a specialist considers memory_limit=-1, require resource isolation with a separately enforced limit, such as Linux Control Groups (cgroups), and confirm which process an OOM kill would terminate. A container-wide kill can take down every worker. PHP specifically warns not to substitute **RLIMIT_AS** or **RLIMIT_DATA**: those limits can cause the very allocation failure the vulnerable code mishandles.⁠⁵

Do not depend on ini_set() or .user.ini to disable session upload progress. Put the setting in php.ini, an FPM pool or the server configuration before parsing begins. For a setting the application must not override, php_admin_value is the relevant FPM control. Disable PHP session upload progress shows where to check. PHP’s 23 October notice also identified CVE-2026-115560, which requires an unusual runtime change to the session serializer while upload progress remains enabled; the 21 October PHP2Shell patches do not address it.⁠¹

Edge limits have gaps you must check

A Web Application Firewall (WAF) using Managed WAF Rules may stop recognized requests before PHP sees them. Reported Cloudflare said its PHP2Shell rules were deployed on 21 October, including for Free users with its WAF enabled, but still advised patching. A reverse proxy or load balancer only inspects traffic routed through it: if attackers can connect to the origin server IP address directly, that creates a potential WAF bypass. Restrict direct origin access and verify the rule’s blocking mode.⁠⁶ Cloudflare WAF protection and its limits covers the distinction.

A matching WAF rule is not a runtime fix.

Enforce an HTTP request body size limit on decoded bytes, not merely an advertised size. For multipart/form-data, review multipart part count, input field count, HTTP request header count, and request nesting depth; also check per-part headers and upload counts. The Content-Length header may be absent or unusable, including during a chunked HTTP upload. PHP recommends front-end limits that still work in those cases. Test which controls your server, proxy and WAF can actually enforce rather than assuming one layer handles all of them.⁠¹⁠⁵

Reduce public exposure while you migrate

Every public PHP entry point adds to the attack surface, even if the application itself has no known bug. Restrict management interfaces by virtual private network (VPN), a jump host or an IP allowlist. Where no trustworthy backport exists and the residual risk is unacceptable, isolate the application or take it offline; the NSA’s 21 October advisory specifically recommends taking unpatchable systems offline until they can be fully mitigated.⁠⁷

Move toward a supported branch rather than treating an EOL backport as a permanent plan. PHP 8.2 reaches end of security support on 31 December 2026; PHP 8.3, 8.4 and 8.5 have listed security-support dates through 2027, 2028 and 2029 respectively. The PHP2Shell patching runbook covers normal supported deployments. Check extension and application compatibility in staging before switching production.⁠³

How you’d notice

Reported CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on 26 October. That establishes exploitation in the wild, not compromise of every PHP server. Look for unusual POST traffic followed by HTTP 500 Internal Server Error spikes, a PHP worker crash, unexpected restarts or errors reporting exhausted memory. Correlate origin logs with WAF decisions and process activity; a blocked request may never reach PHP.⁠⁸

A crash alone does not prove code execution.

Review the period before patching for unfamiliar PHP files, unexpected child processes and outbound connections. Treat these as leads for incident investigation, not signatures unique to PHP2Shell. Preserve relevant logs before rotating or rebuilding systems; normal service health is not proof that an unpatched server was never attacked.

Triage the old-PHP fleet

Do today

1. Identify every web-facing PHP runtime, its exact package build and its vendor patch record for both CVEs.
2. Install a verified fixed vendor build where available; restart workers and confirm the running handler was updated.
3. Restrict public management routes, direct origin access and unneeded PHP endpoints if the patch is unavailable.
4. Disable session upload progress before parsing; evaluate request-size controls and the memory-limit tradeoff with your administrator.

Do this week

5. Test body-size, field, part, header and nesting limits against real application requests and chunked transfers.
6. Review server logs, WAF events and worker failures from before the fix; investigate suspicious correlations.
7. Stage migration to a maintained PHP branch, including extension and application compatibility tests.

Can wait

8. Schedule full migration within your vendor’s support window if a verified backport is already running.
9. Reassess the session-upload-progress workaround when PHP publishes a stable fix for CVE-2026-115560.