Apache mod_php and PHP2Shell: Why It's the Highest-Risk Setup

As of 23 October 2026, PHP's security team rates Apache with mod_php as the highest-risk setup for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). If your site runs this way, patch first and do everything else second: install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package, then fully restart Apache.

mod_php is the older way of running PHP, where PHP is built into Apache itself as a module. There is no separate PHP service. Every Apache worker process carries its own copy of PHP. It is still common on older servers, on some Debian and Ubuntu installs and in the official Docker images for WordPress, Drupal and Joomla.

This guide explains why PHP singles mod_php out, how to tell whether you use it, how to patch and restart correctly, which settings can help if you can't patch today, and why this is a good moment to move to PHP-FPM.

Why PHP Calls mod_php the Highest Risk

PHP's announcement on php.net lists every web setup as affected, but it ranks mod_php first. The two advisories explain why, at a high level:

• CVE-2026-109618 runs before your code. The GHSA-w8hw advisory says the problem "happens entirely before any application-specific code begins execution." It adds that full remote code execution "was validated over HTTP against mod_php with default PHP input and memory limits and normal prefork configurations with multiple workers."
• CVE-2026-109619 has confirmed mod_php paths. The GHSA-6wmf advisory says its strongest case "is the basis of the confirmed mod_php exploitation," and that session-related remote code execution "was validated against mod_php and FPM." It also notes that under mod_php, .htaccess and Apache php_value settings are "applied before php_request_startup()", which is earlier than the point where PHP normally resets its state.

The practical result is that nothing inside your application can protect you. Bitdefender puts it plainly: "on mod_php, CMS updates, plugin hygiene and application hardening do not change exposure." Only a patched PHP build, or a block in front of PHP, makes a difference. For the background on each flaw, see our CVE-2026-109618 explainer.

How to Tell Whether You Run mod_php

You may be running mod_php without having chosen it. Check these:

• Debian and Ubuntu. Ubuntu's documentation says the PHP module is enabled when /etc/apache2/mods-enabled/php8.*.conf and /etc/apache2/mods-enabled/php8.*.load exist. The package is libapache2-mod-php8.3 (or your version).
• RHEL family. AlmaLinux says PHP-FPM is "the default on every AlmaLinux release" and that "AlmaLinux 9 and 10 do not ship mod_php." On AlmaLinux 8 or RHEL 8, mod_php is possible but not the default.
• Docker. Docker Hub says the php:<version>-apache images contain "Debian's Apache httpd in conjunction with PHP (as mod_php) and uses mpm_prefork by default."
• A phpinfo() page. The Server API line at the top shows how PHP connects to the web server. If it names an Apache module rather than FPM or FastCGI, you are on mod_php. Delete the page right after.

If you are on shared or managed hosting and can't see any of this, ask your host which PHP handler your site uses and whether the patched build is live.

The Official CMS Docker Images Use mod_php

Researchers demonstrated attacks against the official WordPress, Drupal and Joomla container images. The flaw is in PHP, not in those projects, but their default image tags run Apache with mod_php. As of 22 October, the rebuilt images are:

Pulling a new image does not change a running container. Pull or rebuild, then recreate the container. Microsoft's PHP2Shell guidance for Azure says the same about container images: "updating the host does not update PHP inside an image." The official php image tags for 8.1 and 7.4 have not been rebuilt, so no official fixed image exists for those branches. Platform-specific steps are in our PHP2Shell guide for WordPress.

How to Patch mod_php

With mod_php, PHP is updated through the Apache module package, not a separate service.

• Ubuntu. USN-8948-1 lists the fixed module package for each release. On 24.04 LTS it is libapache2-mod-php8.3 8.3.6-0ubuntu0.24.04.13, which still reports PHP 8.3.6. Update with sudo apt update && sudo apt upgrade.
• Debian. Fixed builds include php8.4 8.4.27-1~deb13u1 (trixie) and php8.2 8.2.35-1~deb12u1 (bookworm).
• AlmaLinux 8. AlmaLinux gives sudo dnf clean metadata && sudo dnf upgrade 'php*', and for mod_php: "restart Apache with sudo systemctl restart httpd."
• cPanel and CloudLinux. Update the ea-php packages, then restart Apache with cPanel's /scripts/restartsrv_httpd, as CloudLinux documents.

Version numbers on backported builds stay below PHP's own release numbers. Check the full package version against your distribution's advisory. Our guide to checking your PHP version explains how.

Restart Apache Fully, Not Gracefully

Apache has two kinds of restart, and the difference matters here.

• Graceful restart. Per Apache's documentation, the parent process tells the children "to exit after their current request" and replaces them over time. Open connections are not cut off.
• Restart. The parent "kill[s] off its children" and "spawns a new set of children."

No Apache page says whether a graceful restart loads an updated PHP module file. The distribution and vendor instructions all use a full service restart. Debian's own mod_php package also triggers a full restart, not a graceful one, when PHP extensions change. Follow them:

sudo apachectl configtest (checks the configuration first)
sudo systemctl restart apache2 (Debian and Ubuntu)
sudo systemctl restart httpd (RHEL family)

Apache's documentation says configtest "either reports Syntax Ok or detailed information about the particular syntax error." Run it first so a broken config file doesn't keep Apache from starting again. For other setups and how to confirm a restart, see our guide to restarting PHP workers.

Mitigations in the Apache Configuration

If you can't patch today, PHP's interim settings work under mod_php only when they are set in the right place. PHP's manual says php_admin_value "can not be used in .htaccess files. Any directive type set with php_admin_value can not be overridden by .htaccess or ini_set()." Put lines like these in php.ini or the server or virtual host configuration:

php_admin_value session.upload_progress.enabled 0
php_admin_value memory_limit -1

Be careful with memory_limit -1. It removes PHP's memory cap, so plan an outer memory limit and check that no other virtual host or directory sets a finite limit again. Then do a full Apache restart.

Check your .htaccess files. Under mod_php, .htaccess php_value and php_flag lines run early, before PHP resets its state. PHP's advisory says to "Remove invalid or deprecated settings applied per request that emit diagnostics before initialization." Old WordPress and Joomla sites often carry such lines from past plugins or hosts. Remove any that name settings PHP no longer supports, and move the rest into the server configuration. Hiding the warnings does not help.

The full list of mitigations, and what each one can break, is in our PHP2Shell interim mitigations guide. None of them replaces the update.

Consider Moving to PHP-FPM

Once you're patched, the long-term fix is to stop using mod_php. PHP's Apache installation page now opens with "Do not use mod_php for new installations" and says "For all modern deployments, use PHP-FPM (FastCGI Process Manager) with Apache httpd's mod_proxy_fcgi module." It lists the benefits: "better resource management, process isolation, independent restart of PHP without restarting Apache httpd," and compatibility with the event MPM.

It also explains a cost of mod_php: unless PHP is built with thread safety, "mod_php requires the prefork MPM, which significantly limits concurrency." (An MPM, or multi-processing module, is the part of Apache that decides how it handles connections.)

On Debian and Ubuntu, the FPM package tells you how to enable it under Apache: a2enmod proxy_fcgi setenvif, then a2enconf php8.3-fpm (replace 8.3 with your version). You will also need to disable the mod_php module and may need to change Apache's MPM. Per-directory PHP settings work differently under FPM, so test on a copy of the site first. Our staging sites guide shows how. For containers, switch to the image's -fpm tags behind a web server container. The new setup is covered in our PHP-FPM and PHP2Shell guide.

Don't make the switch your first step during an emergency. Patch, restart and confirm first, then migrate on your own schedule.

If You Think the Site Was Already Attacked

Because mod_php is the setup with a demonstrated exploit, it's worth checking for signs of compromise after you patch. Several security firms suggest looking back to at least 17 October 2026. A clean error log does not prove anything either way. Our incident response plan covers what to preserve and who to call.

Conclusion

As of 23 October 2026, Apache with mod_php is the setup PHP considers most at risk from PHP2Shell, because the attack can run before any application code. Install the patched PHP module package or rebuilt image, run a configuration test, and do a full Apache restart rather than a graceful one. If you must wait, put mitigations in the server configuration with php_admin_value and clean up .htaccess PHP settings. Then plan the move to PHP-FPM that PHP itself recommends. If you need it done quickly and checked, our emergency PHP patching service can help. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions