Updated 23 October 2026. Two critical flaws in the PHP language runtime have prompted an urgent security update for websites and hosting platforms. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. Both carry a 9.2 CVSS v4.0 score and can, under exploitable conditions, allow unauthenticated remote code execution (RCE). The problem is in PHP's internals, not simply a vulnerable plugin or a coding mistake in one website.
This matters to Minecraft communities because many server networks use PHP-based websites, shops, billing portals, custom player dashboards or hosting panels. PHP2Shell does not mean the Minecraft Java or Bedrock game engine is itself vulnerable. The danger is the web software surrounding your server, especially an internet-facing administration panel running unpatched PHP.
What happened on 21 October 2026?
The PHP security team released fixes on 21 October 2026 across all four supported branches. According to the official security advisory, affected servers should be updated immediately. There is no complete mitigation other than installing a fixed build. CERT-EU reported that initial public proofs of concept had begun circulating, increasing the urgency of patching. That does not mean every PHP server has already been exploited.
One concern is that the failures occur in request processing and engine memory management. For some configurations, checks inside the web application may happen too late to block the vulnerable path. The PHP team says mod_php on Apache presents the highest risk, and describes a demonstrated unauthenticated attack before application code runs. PHP-FPM, PHP-CGI, LiteSpeed and FrankenPHP installations must also be assessed.
What are the two vulnerabilities?
CVE-2026-109618: PHP out-of-memory corruption
PHP can interrupt a request when it reaches an internal or configured memory limit. The first flaw arises when this interruption happens while request data is only partly initialized. Cleanup can then treat invalid memory as legitimate data, resulting in memory corruption. In certain conditions, an attacker can turn that mistake into code execution. This is why merely reviewing your Laravel controllers or input validation is not a substitute for a PHP runtime patch.
CVE-2026-109619: Stale state between requests
The second flaw involves temporary internal pointers that may persist after the memory they reference has been freed. If a later request is processed by the same worker, it may encounter this stale state before initialization resets it. This use-after-free situation can also lead to memory corruption and remote code execution. See the independent CERT-EU analysis and the PHP Foundation's explanation for verified details.
Affected PHP versions and patched releases
| PHP branch | Affected upstream versions | First fixed release |
|---|---|---|
| PHP 8.5 | Earlier than 8.5.12 | 8.5.12 |
| PHP 8.4 | Earlier than 8.4.27 | 8.4.27 |
| PHP 8.3 | Earlier than 8.3.36 | 8.3.36 |
| PHP 8.2 | Earlier than 8.2.35 | 8.2.35 |
| PHP 8.1 and older | End-of-life upstream branches | Move to a supported release or a documented vendor-security backport |
Do not judge Ubuntu security status by the upstream version number alone. Linux distributions may backport a fix to an older-looking package version while keeping their normal package naming. Ubuntu's security notice USN-8948-1 documents its patched package revisions across supported releases. Check whether your precise installed package is at least the revision listed for your distribution. PHP 8.2 also reaches upstream end of life on 31 December 2026, so operators still using it should plan a supported upgrade.
What does PHP2Shell mean for Minecraft server hosting?
Most game server processes are not PHP applications. A Minecraft server running Java, Bedrock Dedicated Server or a proxy such as Velocity is not affected by PHP2Shell just because it shares a computer with PHP. However, the supporting web infrastructure might be:
- Game hosting control panels: a PHP application that manages customer accounts, file access or server actions.
- Minecraft network websites: login areas, player profiles, vote-reward pages or application forms.
- Stores and billing portals: PHP-powered services that handle account records and administrator sessions.
- Custom tools: older community dashboards or staff panels that rarely receive runtime updates.
Pterodactyl is an example of a PHP-based hosting panel, not a separately confirmed application exploit. Its official 2.0 documentation specifies PHP 8.3 or PHP 8.4 for the Panel. Anyone operating that version should check the PHP runtime serving the Panel and install a relevant patched build. Wings, Pterodactyl's separate game-server daemon, is not the PHP Panel. Operators advertising communities through our Minecraft server directory should inventory the connected websites and control panels even if the game server itself is hosted on another machine.
How to check a server and apply the PHP2Shell patch
Step 1: Identify the PHP runtime that serves your website
On Linux, different PHP runtimes can coexist. The PHP you see in a terminal may not be the one Nginx, Apache or a Docker container uses for web traffic. Start with an inventory of internet-facing domains, installed PHP packages, configured FPM pools and container images. On Debian or Ubuntu, these read-only checks help:
php -v
systemctl list-units 'php*-fpm.service'
dpkg -l 'php*' | grep '^ii'Match the actual Nginx fastcgi socket or Apache module with the runtime in production, then compare its package revision with the vendor's advisory. Avoid exposing a public phpinfo() diagnostic page; it can reveal sensitive configuration details.
Step 2: Plan a safe update
Take a snapshot or backup of your panel, settings and database before changing production. For Ubuntu servers, refresh package indexes and review what will be updated:
sudo apt update
apt list --upgradableInstall the PHP security packages provided by your operating system, supported PHP repository, panel vendor or container image maintainer. Do not blindly switch major PHP versions: first check your specific Pterodactyl, Laravel or other panel's supported PHP range and required extensions. For Docker, rebuilding an image and recreating the running service may be necessary. For shared hosting, check your host's maintenance advisory and ask it to confirm remediation.
Step 3: Restart and verify the running service
Reloading the web server alone might not replace old PHP workers. Restart the relevant PHP-FPM pool, Apache runtime or container deployment according to your environment and verify the actual web service is using fixed binaries. If you upgrade PHP for Pterodactyl, also restart its queue worker as described in the official PHP upgrade guide, and check its dependency requirements. Test login, panel actions, file uploads, scheduled jobs and Minecraft integrations after deployment.
Review recent PHP crashes, abnormal HTTP requests and unexpected child processes. These can be useful investigation leads, but they are not proof of compromise. If logs or forensics indicate an intrusion, isolate the affected system and follow a proper incident-response plan; patching alone does not remove attacker-installed files or stolen credentials.
What if you cannot patch immediately?
The PHP project's advisory is explicit: there is no complete workaround. CERT-EU recommends isolating vulnerable public-facing systems until updates can be applied. Where possible, restrict a hosting panel to trusted network access, pause unnecessary public services, or take a vulnerable web application temporarily offline.
PHP also describes partial configuration mitigations involving request-body limits, upload-progress behavior and certain error-handling paths. These do not cover every attack vector and can create operational trade-offs. For example, disabling PHP's memory limit can increase resource-exhaustion exposure; it is not a safe universal fix for shared hosting. A web application firewall can reduce known exploit traffic, but cannot guarantee protection against PHP2Shell. Prioritize installing the fixed PHP package instead of relying on temporary settings.
What should Minecraft community administrators do today?
Audit every PHP-powered web property connected to your Minecraft network, not only the main game server. Identify the runtime, confirm whether its exact build contains the 21 October fix, patch it, restart the real serving processes and test the site. Check hosted billing or admin portals with providers as well. These are serious runtime bugs, but operators who deploy verified vendor fixes and validate their services can substantially reduce their exposure.
Official and authoritative sources: PHP Security Team, CERT-EU 2026-018, Ubuntu USN-8948-1, PHP Foundation and Pterodactyl documentation.
