PHP2Shell and the LiteLLM hack: what to do today

On 21 October 2026 PHP fixed two critical bugs that let an attacker run code on a web server without logging in. The same day, LiteLLM 1.107.0 was caught stealing keys. Part 1 is for everyone, part 2 is for people who run a PHP site or use LiteLLM.

What happened

PHP runs about 70% of websites (69.3% of sites whose server language is known, W3Techs (opens in a new tab), 21 October 2026).
Two bugs in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (critical). They allow remote code execution (RCE) with no login. The researchers call them PHP2Shell.
The news leaked on Hacker News on 20 October 2026. PHP released the fixes on 21 October 2026 at 14:00 UTC.
Attacks started fast: watchTowr says its honeypots saw exploitation in the wild on 21 October, and Cloudflare saw attack traffic.
CISA (US), the UK NCSC and the FBI Cyber Division all told PHP users to update now.
The same day, the Python package LiteLLM (about 23 million downloads a week) shipped a poisoned version, 1.107.0, that steals keys and passwords. See the LiteLLM section below.

Part 1: if you just use websites

The bugs are in web servers, not in your phone or laptop. You cannot patch other people's sites, but you can limit the damage if one of them leaks your data:

Use a different password for every site, and let a password manager remember them.
Turn on two-step verification (2FA) wherever you can, especially email and banking.
Do not open surprise links, even if the message looks like it comes from a site you use.
Turn on your bank's alerts, and only call the official numbers printed on your card or the bank's site.

Have a WordPress or other site with a hosting company? Ask them whether your site's PHP is updated, or check the PHP version in your hosting panel (next sections).

Part 2: are you affected?

Almost every PHP version from 5.4 on is hit by at least one of the two bugs. WordPress, Drupal, Joomla, Laravel and plain PHP apps all run on the engine, so updating the app alone does not help.
Apache with mod_php is confirmed. PHP-FPM is confirmed too, through application paths. php-cgi, FrankenPHP and LiteSpeed are also listed.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is vulnerable, unless your Linux distribution backported the fix (next point).
PHP 8.1, 8.0 and 7.4 get no ready official release, only source patches for people who build PHP themselves. Linux distributions ship the fix in their own packages: Debian DSA-6574-1 (opens in a new tab) ships the fixed 8.4.27 and 8.2.35, while Ubuntu USN-8948-1 (opens in a new tab) backports the fix and keeps the old number (8.3.6 on Ubuntu 24.04, 8.1.2 on 22.04). So a fixed server can still show an old number: compare your package version (for example apt policy php8.3) with your distribution's notice.
PHP 7.3 and older: no official fix or patch. Plan the move to a supported version.

Find the version your site really runs

Shared hosting: open your hosting panel (cPanel, Plesk or your host's own) and look for the PHP version or PHP selector page.
Your own server: the terminal command below shows the command-line PHP. Your website can run a different PHP (Apache or PHP-FPM), so also check the version in your panel or a phpinfo page, and delete that page afterwards.

php -v

OpenAI's free php2shell-checker (opens in a new tab) reads the version a site announces in its headers. It answers OK, VULNERABLE or UNKNOWN. UNKNOWN does not mean safe, OK only compares a version number, and a distribution backport can show VULNERABLE on a server that is already fixed.

Update PHP

Hosting panel

Pick 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer) in the PHP version page. If your host has no fixed version yet, ask them when it lands.

Ubuntu or Debian server

Install the updates from your distribution:
```
sudo apt update && sudo apt upgrade
```
Restart the web server so it loads the new PHP. Old PHP processes keep running the old code until you do. For Apache:
```
sudo systemctl restart apache2
```
For PHP-FPM, use your version in the name (8.3 here):
```
sudo systemctl restart php8.3-fpm
```

Docker

The fix comes in rebuilt official PHP images. Pull the new images, rebuild your own images on top of them, and restart. An image pinned to an old tag or digest keeps the old PHP, so move the pin to a fixed version.

docker compose pull --ignore-buildable && docker compose build --pull && docker compose up -d

If you cannot update today

There is no complete workaround: updating is the only safe fix. CISA (opens in a new tab) says systems that cannot be updated right away, or that run PHP 8.1 or older, should go offline until they are patched. The UK NCSC (opens in a new tab) says to apply the temporary mitigations, and if you cannot, to consider taking the system offline.

Temporary mitigations

Turn off session.upload_progress.enabled.
Lower post_max_size and max_input_nesting_level.
Recycle PHP-FPM workers after every request with pm.max_requests = 1.
Block multipart uploads where your site does not need them, and limit request size in front of PHP.
Do not use RLIMIT_AS or RLIMIT_DATA to cap memory: the advisory says they trigger the vulnerable path.
A WAF or CDN rule helps but is not enough on its own.

Check for a break-in

Keep and read your web server logs, and look at the signs listed on php2shell.com (opens in a new tab).
If you think the server was hit: isolate it, keep the logs, change every password and key the server could read, and sign all users out.

Installed LiteLLM 1.107.0?

LiteLLM 1.107.0 on PyPI (published 21 October 2026 at 11:39 UTC) and its official Docker images (tags v1.107.0, latest, main-latest and main-stable) were poisoned. The code runs as soon as Python starts, without any import, and steals cloud keys, API keys, SSH keys, AI tool logins and browser data.

Check without starting that Python: the bad code runs every time Python starts, even for pip. In your project folder, if the environment is .venv:
```
ls .venv/lib/python3*/site-packages | grep -i -e litellm -e cook.pth
```
On Windows, open .venv\Lib\site-packages in File Explorer and look for the same names.
If you see litellm-1.107.0.dist-info or cook.pth, or you pulled one of those Docker tags that day, treat the machine as exposed and do not run Python in that environment again.
Delete that environment (or container). If you installed LiteLLM outside a virtual environment, the safest move is to set the machine up again; at the very least remove LiteLLM, cook.pth and the sitecustomize.py it added.
Then change every key and password that machine could read: cloud, AI providers, GitHub, SSH, GPG and TLS keys, LiteLLM proxy credentials, and saved browser logins.
Make a fresh environment and install the safe version:
```
pip install "litellm==1.106.2"
```

Sources

Checked against the official advisories on 21 and 22 October 2026. There may be news since then, so check the sources.