PHP2Shell vulnerability: security alert for every game server (CVE-2026-109618)

Contents#

• PHP2Shell in two minutes
• Why game servers are on the front line
• What is affected on your server, and who needs to act
• The fixed PHP versions
• Step by step for administrators
• If you can't update right away
• What about players
• FAQ
• Sources

Introduction#

On 20 October 2026, the PHP security team did something fairly unusual: it publicly announced that a critical fix would ship the next day, because information about two vulnerabilities had already leaked online. On Wednesday 21 October at 14:00 UTC, the patched versions were out. The nickname these flaws picked up, PHP2Shell, sums up what is at stake: getting full access (a "shell") to the server, with no account and no password.

Your Minecraft or FiveM server doesn't run on PHP, that's true. Its website, store, voting page and often its management panel do. Azuriom, CraftMyWebsite, NamelessMC, WordPress, Pterodactyl: the most common tools among game server admins are all written in PHP. Here is what to check today, and in which order.

PHP2Shell in two minutes#

PHP2Shell covers two vulnerabilities in the very core of PHP. The project's security team gives each of them a score of 9.2 out of 10 (CVSS v4.0).

• CVE-2026-109618, corruption on out-of-memory. When a request exhausts the allowed memory, PHP stops while some internal data is only half initialized. The end-of-request cleanup then treats that data as valid.
• CVE-2026-109619, stale global state. Information tied to one request survives after the memory holding it has been freed. The next request handled by the same process uses it before it gets reset.

In both cases, the outcome demonstrated by researchers is the same: remote code execution, without authentication, with the web server's privileges.

The detail that changes everything: on Apache with mod_php, the PHP team says a single anonymous request can trigger the attack before the site's own code even runs. Your CMS can be fully up to date and your extensions spotless, it makes no difference. The flaw sits underneath.

Why this can't wait until next week:

• the technical details of both flaws and an exploitation tool are already public;
• watchTowr and other security firms report the first real-world exploitation;
• according to Sansec, every version since PHP 5.4 is likely affected, which covers pretty much everything still running on the web;
• an attack complexity rated "high" on paper counts for little once a ready-made tool is circulating.

Why game servers are on the front line#

A large online store has a technical team that probably spent the night on this. A 40-player Minecraft server is often one founder, two moderators and a website installed two years ago on a five-euro-a-month VPS that nobody has touched since. That is exactly the profile automated scans find first.

Our world also has a problem of its own: abandoned CMS. MineWeb, long widely used by French-speaking servers, is no longer maintained and requires PHP 7.4 at most. The PHP project publishes no official fixed release for 7.4, 8.0 and 8.1. It has only put out minimal source-code patches, which you have to compile yourself. On shared hosting, that simply means there is no easy fix. We already explained in our Minecraft CMS comparison why it was time to move away from it, and this week gives a very concrete example.

The consequences of a compromised site are anything but theoretical. A hacked store can be used to divert payments, steal player credentials or show a fake login page in the server's colours. Not to mention the loss of trust, which is much harder to rebuild than a website.

What is affected on your server, and who needs to act#

The panel deserves special attention. Whoever takes it over controls every game server it manages, the API keys and often the backups. Good news for the nodes, though: Wings, the service that runs the servers on each machine, is written in Go and isn't affected by the flaw.

On Tebex, one nuance: the store itself is hosted by Tebex, so there is no PHP for you to update there. If your own site displays the store through a module, that site is the one to check.

The fixed PHP versions#

Linux distributions and long-term support vendors received the patches in advance: on Debian, Ubuntu or AlmaLinux, updated packages should arrive quickly through your usual package manager. Be careful if you use the remi repository, very common on Red Hat-family distributions: the PHP team warns it won't have an update on release day, and advises switching to your distribution's packages or building from source.

If your site still runs 8.2, take the opportunity to plan the move to 8.3 or 8.4: in ten weeks, that branch won't receive anything anymore.

Step by step for administrators#

1. List everything that runs PHP. Website, store, voting, forum, wiki, panel, and the forgotten subdomains too. The "test.myserver.com" you set up in 2023 to try a theme counts just as much as the main site.
2. Check the version used by the web, not just the one in your terminal. The php -v command shows the command-line version, which can differ from the one used by PHP-FPM or Apache. Your hosting control panel or a temporary phpinfo() page (deleted right afterwards) gives you the real answer.
3. On shared or managed hosting, ask your host for the exact version that has been applied. An answer like "we're on it" isn't enough.
4. On a VPS or dedicated server, update the packages (apt update && apt upgrade on Debian and Ubuntu, dnf upgrade on AlmaLinux or Rocky), then restart every PHP process: the php-fpm service, Apache if it uses mod_php, the lsphp processes on LiteSpeed. Restarting Nginx alone doesn't reload PHP.
5. For a Pterodactyl or Pelican panel, apply the same treatment to the PHP that runs the panel, then review the list of users and API keys.
6. Once you're up to date, look for traces. Recently created PHP files in the site folder, unknown admin accounts in the CMS, strange redirects, load spikes. If in doubt, change passwords, the API keys of your store and panel, and the link key between your site and your game server (AzLink on Azuriom).

Finding nothing unusual in the logs doesn't prove much, and the PHP team says so itself. If you have a serious doubt, the safest option is to restore a backup from before 20 October, then apply the update before putting the site back online.

If you can't update right away#

Let's be clear: none of these measures makes an installation safe, and the PHP team insists on that point. They reduce exposure until the fix is in place.

• Disable upload progress tracking with session.upload_progress.enabled = 0, in php.ini or the FPM pool configuration, then restart every worker. Not through ini_set() or a .user.ini file, which are applied too late. A game server website almost never uses this feature, so you can leave it off even after patching.
• Shrink the accepted request size: post_max_size = 8M if the site doesn't take file uploads, 32M otherwise, with a lower upload_max_filesize.
• Remove the controllable memory limit by enforcing memory_limit = -1 at admin level (php_admin_value in the FPM pool or Apache configuration). Pair it with a container or cgroup limit, otherwise a single greedy request can saturate the machine.
• On PHP 8.5, set fatal_error_backtraces = 0.
• Filter upstream: Sansec recommends blocking multipart/form-data requests at web server level when the site doesn't need them, or putting the site behind Cloudflare while you patch.

Last resort, recommended by CERT-EU for organisations that can't patch: take the site off the internet. For a game server, a maintenance page for 48 hours costs far less than a player account database out in the wild.

What about players#

You don't need to change anything in your game. A few habits are still worth it this week:

• use a different password for every server store and forum, because a single stolen database is enough to test your credentials elsewhere;
• turn on two-factor authentication wherever it's offered;
• be wary of a server website that suddenly redirects you somewhere else or asks you to download a "mandatory launcher";
• if a server announces an incident, change your password there and everywhere you reused it.

Sansec also points out that one of the two flaws can leak pieces of the server's memory. On a poorly patched site, fragments of data processed for other visitors can therefore get out. One more reason not to recycle your passwords.

FAQ#

Does PHP2Shell affect my Minecraft server itself?#

No. Minecraft Java servers run on Java, Bedrock servers on C++, and FiveM and Garry's Mod rely on their own engines. The risk comes from the web services around them, and from the panel if it's installed on the same machine as the game server.

My site is on shared hosting, do I need to do anything?#

Yes: check. Your host applies the update, but you're often the one choosing the PHP branch in the control panel. If your site is set to an abandoned version like 7.4 or 8.1 to stay compatible with an old CMS, nothing guarantees that the host's update protects you.

I use a Tebex store, am I affected?#

Not for the store itself, which is hosted and maintained by Tebex. The site where you embed it, your CMS or your forum, still needs to be checked like any other PHP site.

Is Azuriom vulnerable?#

The flaw doesn't come from Azuriom but from PHP, the language it's built on. An Azuriom installation running on unpatched PHP is therefore exposed, like any PHP CMS. Updating PHP is enough: there's nothing to reinstall on the CMS side.

How do I know if my site has already been hacked?#

The most common signs: unknown PHP files created recently, an admin account nobody recognises, redirects to other sites, a warning from your host or abnormal CPU usage. None of these signs is absolute proof, and neither is their absence. If you have a real doubt, restore a clean backup, update PHP, then change every access credential.

Conclusion#

PHP2Shell doesn't target any game in particular, and that's exactly what makes it dangerous for our ecosystem: it goes through the part many admins tend to forget once the site is live. The update takes about ten minutes on a VPS and one ticket on shared hosting. The real work concerns sites stuck on abandoned versions, MineWeb first among them, for which migrating is no longer something you can keep putting off.

Once your infrastructure is patched, the next step stays the same: keeping your community alive. You can list your server for free on ServeurListe and show up in our Minecraft server rankings.

Sources#

• www.php.net/archive/2026.php#2026-10-21-5 (PHP security advisory)
• www.php.net/archive/2026.php#2026-10-20-1 (advance notice of the security release)
• www.php.net/archive/2026.php#2026-10-21-4 (PHP 8.5.12)
• www.php.net/archive/2026.php#2026-10-21-3 (PHP 8.4.27)
• www.php.net/archive/2026.php#2026-10-21-2 (PHP 8.3.36)
• www.php.net/archive/2026.php#2026-10-21-1 (PHP 8.2.35)
• github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• cert.europa.eu/publications/security-advisories/2026-018 (CERT-EU)
• sansec.io/research/php2shell (Sansec)
• watchtowr.com/intelligence/php-cve-2026-109618-faq (watchTowr)