Preloader
Security Advisory

PHP2Shell (CVE-2026-109618): How to Check and Patch the PHP in Your IPTV Panel

What the PHP2Shell vulnerability is, which PHP versions are affected, why IPTV panels need a different check than normal web servers, and how to fix it on your panel.

Published: 3 November 2026

Short answer PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026. They allow remote code execution without logging in on PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12; NVD also lists PHP 7.3 and 7.4 as affected. IPTV panels usually bundle their own PHP, so check the panel's PHP binary, not the system PHP.
PHP2Shell key facts (source: NVD, checked 3 November 2026)
CVE IDsCVE-2026-109618 (out-of-memory handling leaves request memory uninitialized), CVE-2026-109619 (global state keeps pointing at freed request memory)
Published21 October 2026, CVE source security@php.net
AffectedPHP before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12. NVD lists CVE-2026-109618 from PHP 7.3.0 and CVE-2026-109619 from PHP 5.4.0.
Fixed inPHP 8.2.35, 8.3.36, 8.4.27, 8.5.12
PHP 7.xListed as affected by NVD (7.3 and 7.4 for both CVEs). End of life: no official fix.
ImpactRemote code execution, no login and no user interaction required
CVSS 3.1 (NVD)CVE-2026-109618: 9.8 critical. CVE-2026-109619: 8.1 high
CVSS 4.0 (PHP)9.2 critical for both
ExploitedBoth CVEs added to the CISA Known Exploited Vulnerabilities catalog on 26 October 2026
AdvisoriesGHSA-w8hw-w9fx-j79w (CVE-2026-109618), GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

On this page

Disclosure: Xtream-Masters sells an IPTV/OTT panel. Vulnerability facts on this page come only from the NVD entries and the PHP security advisories linked above. The same checklist is published on GitHub as PHP2SHELL.md, maintained by the Xtream-Masters team.

What is PHP2Shell?

PHP2Shell is the name used for two related vulnerabilities in the PHP interpreter itself, not in a specific application. Both were reported by the PHP project (CVE source security@php.net) and published on 21 October 2026, together with fixed releases for every supported PHP branch.

  • CVE-2026-109618: PHP uses longjmp() to abort a request when it runs out of memory. Some code paths leave request memory uninitialized before an allocation, and the request cleanup can then read or branch on that memory. According to NVD, several out-of-memory strategies trigger this reliably and lead to remote code execution.
  • CVE-2026-109619: some global state in PHP temporarily points into request memory and is not always reset correctly. A later request can then read stale state that refers to freed memory, which NVD also describes as leading to remote code execution.

NVD rates CVE-2026-109618 at CVSS 3.1 9.8 (network attack, low complexity, no privileges, no user interaction) and CVE-2026-109619 at 8.1 (high attack complexity). CISA added both to its Known Exploited Vulnerabilities catalog on 26 October 2026, which means attacks have been seen, not only theorised.

Which versions are listed matters. The PHP advisories give fixed releases for 8.2, 8.3, 8.4 and 8.5 and state no lower version bound. NVD's records name PHP 7.3 and later (CVE-2026-109618) and 5.4 and later (CVE-2026-109619). PHP 7.x is end of life, so no official fix will ship. An end-of-life PHP gets no security fixes at all.

Why IPTV panels are a special case

On a normal Ubuntu web server you install the distribution's PHP fix with apt upgrade, restart PHP-FPM and you are done. IPTV panels usually work differently:

  • Bundled PHP. Most IPTV panels (Xtream UI, XUI.ONE and Xtream Codes forks) ship their own PHP binary inside the panel folder and run their own PHP-FPM and nginx with it.
  • apt upgrade does not touch it. The system packages and the panel's bundled binary are separate files. You can be fully up to date on Ubuntu and still run an old, unpatched PHP for the panel.
  • Abandoned panels stay exposed. If the panel is no longer maintained, nobody builds a fixed PHP for it.
  • Many servers. Every main server and every load balancer carries its own copy of the binary. One forgotten load balancer is enough.
apt upgradeupdates /usr/bin/phppanel still runs its own bundled PHPonly a vendor build or migration fixes it

How to check which PHP your IPTV panel really runs

Do not run php -v on its own: that only shows the system PHP, which may not be the one serving your panel. Find the binary the running processes use, then ask that exact binary for its version.

Step 1: List the running PHP processes

# list running PHP-FPM / PHP processes and the binary path they use ps -eo pid,cmd | grep -E "php(-fpm)?" | grep -v grep

Step 2: Ask that binary for its version

# use the path from step 1, for example: /path/from/above/php -v # PHP-FPM master processes often show only their config file, not the binary. # In that case resolve the binary from the process ID (PID) in step 1: readlink -f /proc/PID/exe /path/returned/above -v

Step 3: Repeat on every server

Run the same check on the main server and on every load balancer. Compare each version with the facts table: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer on that branch is fixed; anything older is affected; 7.x has no official fix.

Reduce exposure now (any panel)

These steps do not fix PHP, but they cut down who can reach it while you plan the real fix:

  • Put the admin and reseller login behind access codes or a non-default path, and firewall the panel port to known IP addresses where you can.
  • Firewall SSH and database ports to known IP addresses.
  • Keep streaming ports open only on the servers that need them.
  • Take a fresh database backup and download it off the server before you change anything.
  • Look for files you did not create in the panel's web folders and for unknown admin or reseller accounts. If you find any, treat the server as compromised and rebuild it rather than cleaning it.
Careful with firewalls on streaming servers. Before you enable a firewall rule set, allow your own SSH IP and every port your customers stream on, or you will lock out yourself and your users.

How to fix PHP2Shell, by panel type

Your situationWhat to do
Plain PHP site or app on Ubuntu packagesUpdate PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer on your branch and restart PHP-FPM.
Maintained IPTV panelApply the vendor's PHP update on every main server and load balancer, then re-run the version check above.
Unmaintained panel (no vendor updates)A bundled PHP that nobody patches stays exposed. Lock it down now and plan a migration to a maintained panel. Your database (users, lines, bouquets, streams, movies, series, resellers) can be moved.
Xtream UINo vendor updates are published for Xtream UI. Treat it as an unmaintained panel.
XUI.ONECheck the vendor's own announcements and update channel for a PHP update.
Xtream-MastersMove every server to Solo, see the next section.
Do not copy PHP binaries between panels. A PHP build is compiled for one panel's paths, extensions and configuration. Running a "patch" built for another panel can break yours, and unknown scripts from forums can contain malware.

Xtream-Masters servers: move to Solo

If you run the Xtream-Masters OTT panel, the fix is in the panel itself:

Main server: Migrate to Solo

Open Manage Servers. For a main server without the Solo tag, open Options, then Main, and choose Migrate to Solo.

Load balancers: Reinstall Balancer with Solo

For every load balancer without the Solo tag, choose Reinstall Balancer and select Solo.

When every server in Manage Servers shows the Solo tag, you are done.

Cannot move to Solo yet? Xtream-Masters provides a patched PHP 7.4 build for its own servers. You find it in the security notice inside your panel. It only works on Xtream-Masters installations: do not run it on Xtream UI, XUI.ONE or any other panel.

Migrating from Xtream UI, XUI.ONE or NXT

If your panel gets no PHP updates, every new PHP flaw is another one you cannot fix. Moving to a maintained panel is a database migration, not a rebuild. The Xtream-Masters OTT panel imports Xtream UI, XUI.ONE and NXT databases (users, lines, bouquets, streams, movies, series, categories, resellers and settings) on a fresh Ubuntu server, 20.04 to 26.04. The license is €40/month until 31 December 2026, then €70/month from 1 January 2027.

Sources: NVD CVE-2026-109618 and CVE-2026-109619, PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, CISA Known Exploited Vulnerabilities catalog.

Maintained IPTV Panel

Xtream-Masters OTT Panel

Leave the unpatched panel behind

Install on your own Ubuntu server, import your Xtream UI, XUI.ONE, NXT or other panel database in 3 steps and run unlimited load balancers on one license.

Buy Panel License Panel Details
Xtream-Masters OTT panel dashboard, a maintained alternative to unpatched IPTV panels
OTT Panel License €40/Month

€40/month until 31 December 2026. €70/month from 1 January 2027.

  • Imports Xtream UI, XUI.ONE and NXT databases
  • Ubuntu 20.04 to 26.04
  • Main server + unlimited load balancers
  • PHP2Shell fix built into the panel (Solo)
Get Your License
PHP2Shell Questions

PHP2Shell Vulnerability: FAQ

01

What is PHP2Shell?

PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026. Memory errors in the PHP request cycle can be triggered remotely and lead to remote code execution without logging in. NVD scores CVE-2026-109618 at CVSS 3.1 9.8 (critical) and CVE-2026-109619 at 8.1 (high).

02

Is PHP 7.4 affected by PHP2Shell?

Yes. NVD lists PHP 7.3 and 7.4 as affected by both PHP2Shell CVEs, and PHP 7.x is end of life, so the PHP project will not publish a fix. Treat any panel that still runs PHP 7.4 as unpatched until its vendor ships a fixed build.

03

Does apt upgrade fix my IPTV panel?

Usually not. apt upgrade updates the PHP packages of your Ubuntu system, but most IPTV panels (Xtream UI, XUI.ONE and Xtream Codes forks) run their own bundled PHP binary inside the panel folder. That binary only changes when the panel vendor ships a new build.

04

How do I check which PHP version my panel uses?

Run ps -eo pid,cmd | grep -E "php(-fpm)?" | grep -v grep to list the running PHP processes and the binary path they use. Then run that exact binary with -v, for example /path/from/above/php -v. If the process line does not show a path, run readlink -f /proc/PID/exe. Check every main server and every load balancer.

05

Is Xtream UI or XUI.ONE patched for PHP2Shell?

No vendor updates are published for Xtream UI, so its bundled PHP stays as it is. For XUI.ONE, check the vendor's own announcements and update channel. If your panel gets no updates, the lasting fix is to migrate to a maintained panel.

06

How do I fix PHP2Shell on Xtream-Masters?

In the panel open Manage Servers. For every server without the Solo tag: on the main server choose Options, Main, Migrate to Solo; on a load balancer choose Reinstall Balancer and select Solo. If you cannot move to Solo yet, use the patched PHP 7.4 build from the panel's security notice. It only works on Xtream-Masters servers.

PHP2Shell checklist on GitHub
Important Legal Notice
Xtream-Masters is a software development company. We build and license professional software. We don't host, store, stream, index, or distribute any audio, video, playlists, channels, or DRM-protected content of any kind. What we sell is an empty technical platform; whatever content runs through it is added, configured, and controlled entirely by the end user, who is responsible for holding the proper rights and following the law in their region. Any copyright or DMCA complaints should go to whoever is operating the stream or hosting the URL in question, not to us. For the full picture, have a look at our Terms, Privacy Policy, and Refund Policy.