PHP2Shell: How to Check and Secure Your PHP Server with ChatGPT — Free AI Prompt

By Ahmad Samilo — Software Engineer, AI Consultant & Tech Leader

Published: October 22, 2026

The recent disclosure of two critical PHP vulnerabilities has raised serious security concerns for website owners, developers, hosting providers, and system administrators worldwide.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been collectively referred to as PHP2Shell.

Both vulnerabilities received a critical severity rating of 9.2 under CVSS v4.0 and can potentially allow unauthenticated remote code execution on vulnerable PHP installations.

The good news is that official security patches are available.

The challenge is applying those patches correctly across different server environments without disrupting production websites.

In this article, I’ll explain what you need to know and share a free ChatGPT prompt designed to guide you through server assessment, remediation, and verification.

Download the prompt file here PHP2Shell

Understanding the PHP2Shell Vulnerabilities

On October 21, 2026, the PHP development team released emergency updates addressing two critical security vulnerabilities.

CVE-2026-109618

This vulnerability involves memory corruption during PHP’s out-of-memory handling.

Under certain conditions, specially crafted requests may exploit improper memory cleanup and potentially allow remote code execution.

CVE-2026-109619

This vulnerability involves the unsafe reuse of internal state after memory has been freed.

A subsequent request may interact with stale state, potentially leading to memory disclosure or remote code execution.

The vulnerabilities can affect PHP installations running behind Apache, Nginx with PHP-FPM, OpenLiteSpeed, LiteSpeed Enterprise, and other supported PHP execution environments.

Importantly, the issue exists within PHP itself. Updating WordPress, Laravel, or another PHP application does not replace the need to patch the PHP runtime.

Which PHP Versions Are Affected?

The PHP project released the following corrected versions on October 21, 2026:

PHP Branch	Initial Fixed Version
PHP 8.2	8.2.35
PHP 8.3	8.3.36
PHP 8.4	8.4.27
PHP 8.5	8.5.12

PHP 8.1 and older are no longer supported by the upstream PHP project. Some Linux distributions and hosting software vendors may provide independently maintained security backports.

This distinction is important.

For example, an older PHP installation might continue displaying the same upstream version number while its vendor package includes a security fix.

Therefore, administrators must verify the complete package version and vendor security advisory, not simply compare the output of php -v.

Why Updating PHP Is Not Always Straightforward

PHP servers are not all configured the same way.

A server running AlmaLinux with cPanel/WHM commonly uses EasyApache 4 packages, such as ea-php83.

A server running CyberPanel with OpenLiteSpeed typically uses LiteSpeed packages, such as lsphp83.

Other environments may use distribution packages, containers, source installations, or additional third-party repositories.

Applying the wrong commands can lead to:

Unexpected dependency changes
Missing PHP extensions
Incompatible application configurations
Service interruptions
Websites returning HTTP 500 or 503 errors
Production applications running an unintended PHP version

This is why checking the environment is essential before attempting an upgrade.

My Experience Updating Production Servers

Following the security disclosure, I worked through the remediation process on multiple Linux hosting environments, including:

AlmaLinux with cPanel/WHM and EasyApache 4
AlmaLinux with CyberPanel and OpenLiteSpeed

The process involved identifying installed PHP versions, checking package repositories, reviewing pending updates, applying vendor security patches, and verifying website configurations.

One important finding was that a server could have several PHP versions installed while individual websites used only a subset of them.

Another was that older PHP branches required additional verification of vendor-maintained security backports.

The experience reinforced an important principle:

Successful server security is not just about installing updates. It is about understanding the environment, applying the appropriate changes, and verifying the result.

Can ChatGPT Help Secure Your PHP Server?

Yes — provided it is used responsibly.

ChatGPT can help administrators interpret system information, identify potentially affected versions, understand package-manager output, and develop a structured remediation procedure.

However, AI-generated instructions must be validated against current official documentation.

ChatGPT should not be treated as an autonomous replacement for an experienced system administrator.

The best approach is to use it as a technical assistant that guides the process interactively.

That is why I prepared the following reusable prompt.

Free PHP Security Remediation Prompt

Prompt name: PHP2Shell Security Assessment & Remediation Assistant

This prompt instructs ChatGPT to collect information about your server before suggesting any changes.

It covers:

Server environment identification
Read-only diagnostics
PHP vulnerability assessment
Backup and upgrade planning
Step-by-step remediation
Post-update verification
Security follow-up and reporting

How to use the prompt

Open a new ChatGPT conversation.
Copy the prompt below.
Paste it into ChatGPT.
Provide your server details when requested.
Execute only the commands you understand and have verified.
Share the diagnostic output after removing confidential information.

PHP Security Prompt

Copy the following prompt:

Act as a Senior Linux System Administrator, PHP Security Engineer, and Incident Response Specialist.

Your mission is to help me assess and safely remediate the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 on my server.

IMPORTANT: Do not provide installation, upgrade, deletion, or service-restart commands immediately. First collect information about my environment.

PHASE 1 — SERVER IDENTIFICATION

Ask me to provide:

Operating system and exact version.
Hosting provider and server type.
Control panel and version.
Web server software.
Whether I have root or sudo SSH access.
Whether the server hosts production websites, databases, or email services.
Whether a recent verified backup or snapshot exists.

Never request passwords, SSH private keys, API tokens, or other credentials.

PHASE 2 — READ-ONLY DIAGNOSTICS

Based on my server environment, provide appropriate read-only SSH commands to identify:

Installed PHP versions and full package release numbers
PHP versions actually assigned to hosted websites
Enabled package repositories
Available security updates
Active PHP handlers and running processes
Disk space and service status

Do not assume the CLI PHP version matches the version used by websites.

Provide a small number of commands, explain what each does, and wait for my results.

PHASE 3 — SECURITY ASSESSMENT

Verify current information against official PHP security advisories and relevant operating-system and package-vendor documentation.

Check whether my server is affected by CVE-2026-109618 or CVE-2026-109619.

The initial fixed upstream PHP releases are:

PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12

For older PHP versions, verify whether my exact vendor package includes a documented security backport.

Never assume that an unsupported upstream version is secure without evidence.

PHASE 4 — SAFE REMEDIATION PLAN

Before suggesting any changes:

Confirm a recent, restorable backup.
Identify production dependencies.
Check available disk space.
Review package dependencies.
Perform a package-manager dry run whenever possible.
Identify potential package removals and compatibility risks.
Prefer official vendor repositories.
Avoid unnecessary major-version upgrades.
Never remove PHP versions still required by production websites.

Explain any potential downtime.

Provide commands appropriate to my specific environment, one step at a time.

Wait for my response before proceeding.

PHASE 5 — UPDATE AND VERIFICATION

After I confirm that updates have been applied:

Verify the installed PHP package versions.
Check for remaining pending security updates.
Confirm that active PHP processes use updated binaries.
Recommend appropriate graceful service reloads when necessary.
Verify website availability.
Review relevant error logs.
Identify unsupported or unverified PHP installations.

Do not declare a server fully secure simply because the package manager reports no available updates.

PHASE 6 — SECURITY FOLLOW-UP

If there is evidence of possible exploitation, guide me through read-only incident-response checks.

Prioritize preserving logs and forensic evidence.

Do not delete suspicious files or modify potentially compromised data without explicit authorization.

FINAL REPORT

Provide a clear report containing:

Server environment
PHP versions before and after remediation
Confirmed patched versions
Unsupported or unverified installations
Updates completed
Verification results
Remaining security risks
Recommended next actions

COMMUNICATION RULES

Communicate professionally and clearly.

Guide me interactively like an experienced Linux system administrator.

Distinguish read-only diagnostics from commands that modify the server.

Never assume that you have executed server commands yourself.

Never provide destructive commands without explaining their impact and obtaining confirmation.

START NOW by asking me for my server information. Do not provide update commands yet.

Important Security Recommendations

Even after updating PHP, administrators should follow several security practices.

Maintain Reliable Backups

Keep regular backups and periodically verify that they can actually be restored.

Before major infrastructure changes, consider taking a server snapshot.

Avoid Unsupported PHP Versions

Move websites away from outdated PHP branches after compatibility testing.

Keep Applications Updated

PHP security updates do not replace application-level updates for WordPress, Laravel, plugins, frameworks, and dependencies.

Monitor Server Logs

Review relevant access logs, error logs, and security alerts for suspicious activity.

Applying a patch prevents future exploitation of the corrected vulnerability, but it does not automatically remove a compromise that occurred before patching.

Apply the Principle of Least Privilege

Limit administrative access and ensure that services and applications operate with only the permissions they require.

Final Thoughts

Artificial intelligence is becoming an increasingly valuable tool for software engineers and system administrators.

It can accelerate research, simplify diagnostics, and help teams respond to incidents more efficiently.

But understanding the system, assessing operational risks, and validating the results remain essential engineering responsibilities.

AI can guide the process. Engineering expertise makes the process reliable.

If you’re managing a PHP-based website or Linux server, I hope this guide and prompt help you approach the latest security updates with greater confidence.

Stay secure.

Official References

cPanel PHP security · CVE-2026-109618 · CVE-2026-109619 · CyberPanel PHP update · PHP security update