Skip to content

Guide

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on a Mac

Two critical flaws in PHP itself can allow remote code execution without logging in. macOS doesn't come with PHP, so if you have it, you installed it. Here's how to find which PHP you run and update it.

By the iKnowMyMac team · Updated · 6 min read

The short answer

Run php -v. PHP2Shell is CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2: flaws in PHP's core that can allow remote code execution without authentication. They're fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. If your version is older on the same line, update with whatever installed PHP: brew upgrade php for Homebrew and Valet, herd php:update 8.4 for Laravel Herd (with your version), or a MAMP update. PHP 8.1 and older get no fix from the PHP project, so move to 8.2 or later. php.net says updating is the only complete fix.

On this page

What PHP2Shell is

PHP2Shell is the name given to two vulnerabilities in PHP's core, CVE-2026-109618 and CVE-2026-109619. php.net rates both CVSS 9.2 and says they can allow unauthenticated remote code execution: someone who can send requests to a PHP server can run code on the machine it runs on, without logging in.

  • 8.5

    Update to
    8.5.12 or later

  • 8.4

    Update to
    8.4.27 or later

  • 8.3

    Update to
    8.3.36 or later

  • 8.2

    Update to
    8.2.35 or later. php.net says 8.2 reaches end of life on 31 December 2026.

  • 8.1 or older

    Update to
    No fix from the PHP project. Move to 8.2 or later.
Fixed versions, released 21 October 2026

php.net also lists interim settings that reduce exposure to some attack paths, and says they aren't a complete fix. On a Mac used for development, updating PHP is quicker than applying them.

Check which PHP your Mac runs

macOS stopped including PHP with macOS 12, so any PHP on your Mac came from something you installed. There may be more than one:

The PHP you get in Terminal, and every other one on your PATH
php -v
which -a php

  • /opt/homebrew/

    Installed by
    Homebrew (Laravel Valet uses Homebrew's PHP)
    Update it with
    brew upgrade

  • Herd

    Installed by
    Laravel Herd
    Update it with
    herd php:update, or Herd's PHP settings

  • /Applications/MAMP/

    Installed by
    MAMP
    Update it with
    MAMP
Where each PHP comes from

A local site can run a different PHP from the one in Terminal. In Herd, herd which-php shows the version for the current folder's site. In MAMP, the versions it ships are folders in /Applications/MAMP/bin/php/.

Update PHP from Homebrew (and Valet)

See which PHP formulae you have and which are out of date, then update
brew update
brew list --versions | grep -E "^php"
brew outdated | grep -E "^php"
brew upgrade php

For a versioned formula, name it: brew upgrade php@8.3. Then restart whatever runs PHP, because a running process keeps the old version until it restarts:

Restart PHP after updating
# Laravel Valet
valet restart

# PHP-FPM started with brew services
brew services restart php

If php -v still shows the old version after brew upgrade, Homebrew may not have published the new build yet. Run brew update and try again later.

Update PHP in Laravel Herd

Herd installs its own PHP builds. Herd's docs say an installed version updates to its latest patch release with herd php:update and the version number, and that its preferences window has a PHP tab where versions update with a click.

List Herd's PHP versions, then update each one you use
herd php:list
herd php:update 8.4

MAMP

MAMP ships its own PHP builds, so brew upgrade doesn't change them. Update MAMP itself, then check the versions it includes with ls /Applications/MAMP/bin/php/ and use one at or above the fixed version for its line.

Is a PHP server on your Mac listening?

Remote code execution needs requests to reach a PHP server. To see what's listening on your Mac now:

Listening PHP, nginx and Apache processes
lsof -nP -iTCP -sTCP:LISTEN | grep -Ei "php|nginx|httpd"

An address of 127.0.0.1 or [::1] accepts connections from this Mac only. * or 0.0.0.0, as with php -S 0.0.0.0:8000, accepts them from other machines on your network too. Either way, update: the listing shows what is exposed right now, not what will be tomorrow.

PHP 8.1 and older

php.net says PHP 8.1 and older no longer receive updates from the PHP project. Install a supported version (brew install php installs the current one, or use Herd's PHP settings), move the project to it, and remove the old one when the project runs. If your PHP projects use Composer's certificate bundle, also see the eMudhra certificate guide.

Package Watch in iKnowMyMac

Package Watch in iKnowMyMac checks the Python packages in every environment on your Mac, including certifi, against published advisories.

Sources

  1. 1.PHP security advisory, 21 October 2026 (php.net)
  2. 2.GHSA-w8hw-w9fx-j79w, CVE-2026-109618 (PHP on GitHub)
  3. 3.GHSA-6wmf-4rv5-p3rp, CVE-2026-109619 (PHP on GitHub)
  4. 4.PHP versions (Laravel Herd docs)

FAQ

Questions

Something else? support@iknowmymac.com

Does macOS come with PHP?

Not since macOS 12. If php -v prints a version, PHP came from Homebrew, Laravel Herd, MAMP or another installer.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no fix from the PHP project.

Do I need to restart anything after updating PHP?

Yes. A running PHP process keeps the old version until it restarts: run valet restart for Valet, brew services restart php for PHP-FPM from Homebrew, and stop and start any php -S server.

Is there a fix without updating?

No complete one. php.net lists interim settings that reduce exposure to some attack paths and says updating is the only complete fix.

Know why your Mac is slow.

macOS 15 Sequoia or later · Apple silicon. A 32.6 MB native app, notarized by Apple. No account, no analytics, no telemetry.

Buy iKnowMyMac

One-time purchase · every feature · 14-day refund