The PHP2Shell vulnerability has teams everywhere scrambling to patch, and patching fast often means breaking things you didn’t expect.
Since the early hours after the fix landed, we’ve been helping several customers test for regressions as they roll it out. We know how stressful this is for anyone trying to get their web apps back up safely. So this post covers two things: what PHP2Shell is and which versions fix it, and how to check that your patched app still works before you ship.
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution, which means an attacker does not need an account to run code on your server. They affect PHP installations that serve web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. PHP’s security team considers the risk highest for mod_php, where it has demonstrated an exploit that an unauthenticated request can trigger before any application code runs.
The PHP project released fixes on October 21, 2026, and CISA urged organizations to patch immediately, starting with internet-facing systems. The fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.6.0 RC4 also includes the fix, so update any earlier 8.6 pre-release builds you are testing. PHP 8.1 and older no longer receive updates from the PHP project. If you are on one of those, your options are a backported package from your Linux distribution or LTS vendor, one of the minimal source backports the PHP security team published for PHP 7.4, 8.0 and 8.1, or an upgrade to a supported branch. PHP 8.2 itself reaches end of life on December 31, 2026, so teams patching 8.2 today should plan their next upgrade too. Check the official PHP release announcement for the details that apply to your setup.
If you have not patched yet, do that first. Everything below assumes the fix is going in.
Why patching fast breaks things
The patch is not optional, but the way it goes in under pressure is where regressions come from. A security fix rarely ships alone. It usually arrives with a version bump, a rebuilt base image, a vendor backport or a configuration change, and any of those can change how your application behaves.
Patching in a hurry also means less time in staging, fewer people looking at the change and a strong temptation to treat “the server is back up” as “the app works.” Those are not the same thing. A login page can load while sessions silently fail, and a checkout can render while uploads or payments quietly break.
What can break after the PHP2Shell patch
These are the places worth checking first, because they are directly tied to how teams are applying the fix:
- A jump across PHP versions. If you were on PHP 8.1 or older and upgraded to a supported branch to get the fix, you also picked up every behavior change and deprecation between those versions. This is the single biggest source of regressions in a rushed patch.
- File uploads and large forms. PHP’s interim guidance for CVE-2026-109618 includes setting a low
post_max_size: 8M for applications without file uploads, or 32M if uploads are needed. Any form or upload larger than that limit will stop working until it is raised again. - Upload progress indicators. One of the interim mitigations for CVE-2026-109619 is to set
session.upload_progress.enabled=0. Any feature that relies on PHP’s session upload progress, such as a progress bar on large uploads, will stop reporting. - Memory-heavy requests and jobs. The guidance for CVE-2026-109618 also suggests
memory_limit=-1, which removes PHP’s memory cap, with a container or cgroup limit as the backstop. A script that used to fail fast on a runaway loop can now consume far more memory before that outer limit stops it. - Extensions and libraries. Extensions and dependencies built for one PHP branch do not automatically carry over to another, so a version upgrade can surface errors in code paths that rarely run.
- Rebuilt images and packages. Rebuilding a container or pulling a vendor package to get the fix can update other packages at the same time, which is easy to miss when the only goal is “get the patched PHP in.”
PHP is clear that these mitigations reduce exposure to specific attack paths but do not make an installation safe, so treat them as a stopgap until the update is in. If you applied them before patching, review them once the fixed version is live, so temporary settings do not quietly become permanent ones.
A regression testing checklist for the PHP2Shell fix
The goal is not to retest everything. It is to prove, quickly, that the journeys your users and your revenue depend on still work on the patched build.
- Inventory what changed. List every server, container and environment that got a new PHP version, a new package or a new configuration value. You can’t test a change you don’t know about.
- Smoke test the patched build. Run a fast smoke test on staging first: does the app load, can a user log in, do the core pages respond. If this fails, stop and fix before going further.
- Run your critical user journeys end to end. Sign-up and login, sessions and logout, checkout and payments, forms and file uploads, account settings and admin pages. Test them the way a user would, through the browser, not just by checking that endpoints return 200.
- Check the edges the mitigations touch. Upload the largest file your app supports, submit your biggest form and watch memory on your heaviest requests.
- Check what runs outside the browser. Scheduled jobs, queue workers and imports often run on the same PHP build and fail without anyone looking at a screen.
- Run your full regression suite before production. Once the critical journeys pass, run the broader regression testing suite against the patched build so the long tail of features gets covered too.
- Monitor after release. Watch error rates and key conversion steps after the rollout. CISA also recommends monitoring for suspicious activity, such as PHP worker processes launching shells or downloading tools.
If you can only do part of this today, do steps 2 and 3. A broken login or checkout is the regression your users will notice first.
How we’re helping teams ship the fix
We’ve set up a dedicated response team for PHP2Shell. We’re combining our autonomous QA with human-in-the-loop review, so AI agents run your critical journeys on the patched build while our QA engineers review anything that looks off. That helps you:
- Catch regressions introduced by the patch
- Validate critical user journeys before you go live
- Ship the fix with confidence, not crossed fingers
If you’re affected and want to start testing your patched app right away, you can sign up for free. If you’d rather talk it through with our team first, contact us and we’ll get you sorted.
