PHP2SHELL Patch for Older Versions

A guided helper for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical PHP bugs fixed on 21 October 2026.

The real fix is updating PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. Until you can, this tool applies the temporary settings php.net recommends.

curl -fsSL https://wasdthedebugger.github.io/php2shell/fix | php

Add sudo if PHP's config needs admin rights to edit, or -- --check to only look:

curl -fsSL https://wasdthedebugger.github.io/php2shell/fix | sudo php curl -fsSL https://wasdthedebugger.github.io/php2shell/fix | php -- --check

Or download it first (also works on Windows, where you use curl.exe):

curl -fsSLo php2shell.php https://wasdthedebugger.github.io/php2shell/fix php php2shell.php # guided wizard php php2shell.php --check # look only, change nothing php php2shell.php --undo # restore a backup

One file, nothing to install: it runs on the PHP you already have (5.6+), on Linux, macOS or Windows.

Run it from your project folder: it also scans the project for settings that would undo the fixes. If PHP's config needs admin rights to edit, use sudo php php2shell.php, or on Windows an Administrator prompt.

The wizard asks how your site runs PHP, finds its config file, checks whether your version is patched, then asks about each fix and shows a preview. Nothing is changed until you say yes. Originals are backed up to ~/.php2shell/backups/ first.

https://wasdthedebugger.github.io/php2shell/ has a page for each fix and setup. The site is the plain HTML in docs/, served by GitHub Pages. The tool links to it; set P2S_DOCS_URL at the top of php2shell.php to '' to use the local docs/ folder instead.

Note: the short link serves docs/fix, which is a copy of php2shell.php. After changing the script, update the copy too: cp php2shell.php docs/fix