Is Osclass Affected by PHP2Shell? What to Update in 2026: PHP, Osclass 8.4 and CVE-2026-113381

Quick verdict (updated 29 October 2026)

• PHP2Shell (CVE-2026-109618, CVE-2026-109619) is a PHP flaw. Fix: update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
• CVE-2026-113381 is an Osclass flaw in 8.3.1 and older. Fix: update Osclass to 8.4.0 or newer.
• You need both updates. A PHP update does not fix Osclass, and an Osclass update does not fix PHP.

October 2026 brought two different security problems to Osclass site owners within the same week. One lives in PHP, the language every Osclass installation runs on. The other lives in Osclass core and was fixed in the Osclass 8.4 release. Each is fixed in a different place, and mixing them up is the fastest way to stay vulnerable. Below: what each flaw does, how to check and fix your site, and a checklist for the other threats classifieds sites have faced since 2024.

Is Osclass affected by PHP2Shell?

Osclass code does not contain PHP2Shell, but any Osclass site running on an unpatched PHP version is at risk. PHP2Shell is a bug in the PHP interpreter, so an attacker can take over the whole server through your public website URL. Updating Osclass cannot fix it. Only a PHP update closes it.

The key detail for site owners: on Apache with mod_php, the attack can fire before any application code runs. That means Osclass login checks, CSRF tokens, input filters and security plugins never get a chance to execute. A well-written application does not protect you from a broken interpreter.

What is PHP2Shell?

PHP2Shell is the name given to two critical remote code execution bugs in PHP itself, patched on 21 October 2026. They affect the PHP engine that executes Osclass, WordPress, Magento and any other PHP application. An attacker who succeeds can run their own code on your server, which means full access to files, config.php, the database password and every user record.

According to the PHP Foundation announcement and the PHP2Shell technical analysis by Sansec:

• CVE-2026-109618 is a memory corruption bug. A request that hits memory_limit at the wrong moment can leave half-initialised data that PHP later treats as valid. On Apache with mod_php it can be triggered by an unauthenticated request before any application code runs. On PHP-FPM, remote code execution was confirmed through application code paths.
• CVE-2026-109619 leaves internal state pointing at memory from a previous request after a fatal error (a use-after-free). The reporter showed remote code execution against a real application on Apache with mod_php.
• Which setups are exposed: Apache with mod_php carries the highest risk; PHP-FPM (used with nginx and most modern panels) is also affected. Both are standard ways to run Osclass.
• Both are rated CVSS 9.2 (critical). A score of 10.0 circulated in an early leak, but the official rating is 9.2.
• The vulnerable code dates back to PHP 5.4, so every unpatched PHP version since then is affected, including old 7.x servers.
• All known triggers use multipart/form-data requests, the same request type browsers send when uploading a file. That is why blocking these requests is one of the temporary mitigations, and why it breaks photo uploads.

Exploitation reports differ. Sansec writes that Cloudflare saw first attacks a few hours before the official release and that public proof-of-concept code mostly needs an extra application bug to work. watchTowr reports that CISA added CVE-2026-109618 to its Known Exploited Vulnerabilities catalogue on 26 October. Either way, the safe assumption is simple: attackers are scanning for unpatched PHP right now.

Which PHP versions fix PHP2Shell?

Patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anything lower on the same branch is vulnerable.

Linux distributions (Debian, Ubuntu, RHEL family) and control panels such as Plesk ship their own patched packages. These often keep the original version number with a new package revision, so check the package changelog for the CVE number instead of relying on the version string. The current support dates for each branch are listed on php.net supported versions.

On PHP 8.2? The patch buys you two months. PHP 8.2 stops receiving security fixes on 31 December 2026, so the next PHP flaw after that date will have no fix for 8.2. Apply 8.2.35 now and plan the move to PHP 8.4 or 8.5 before the end of the year.

How do I check my PHP version in Osclass?

Open Osclass backoffice and go to Tools > Configuration info. The Server information block shows the PHP version, memory limit and execution time. You can read more about what the Configuration info screen shows and why it matters.

1. Log in to oc-admin.
2. Open Tools > Configuration info.
3. Find PHP version in the Server information section.
4. Compare it with the table above. For example, 3.30 is vulnerable, 8.3.36 is patched.
5. Repeat for every domain or subdomain: hosting panels often let each site use a different PHP version.

No backoffice access? Ask your host, or upload a temporary file with <?php phpinfo(); and open it in the browser. Delete that file right after, because it reveals server details to anyone.

How do I update PHP on my hosting?

Switch to the patched PHP version in your hosting panel, or update the PHP packages on your server and restart PHP. The exact steps depend on where your site runs:

• Shared hosting (cPanel, DirectAdmin, Plesk): open Select PHP Version or PHP Settings. If the latest patch is not offered, contact support and ask: "Is PHP on my account patched for CVE-2026-109618 and CVE-2026-109619?"
• VPS or dedicated server: run your package manager update (apt update && apt upgrade or dnf upgrade), then restart PHP-FPM and the web server. A PHP update without a restart leaves the old code in memory.
• Docker: pull the new official php image tag and rebuild. The official image does not get fixes for PHP 8.1 and older.
• Managed or reseller hosting: you cannot patch it yourself, so get written confirmation from the provider.

Osclass 8.3.1 and newer fully support PHP 8.5, and Osclass 8.4 requires at least PHP 7.4. If you are still on PHP 7.4 or 8.0, this is the moment to move to 8.4 or 8.5. Our guide on choosing hosting that keeps PHP up to date for Osclass lists what to look for.

Running Docker, XAMPP or a panel with its own PHP build? These ship a separate PHP copy that system updates do not touch. A server can have patched system PHP while the site still runs an old bundled one, so always check the version Osclass reports, not the one on the command line.

Has my hosting provider already patched PHP2Shell?

Do not assume it. Check the PHP version in Osclass and ask your host for written confirmation. A host may have patched the PHP builds it manages, but an account set to an older version, such as PHP 8.1, stays on that version until you change it. Ask support one clear question: "Is the PHP version on my account patched for CVE-2026-109618 and CVE-2026-109619?"

How do I confirm the PHP and Osclass updates worked?

Open Tools > Configuration info again and check that the PHP version shows the patched release, then test the forms your users rely on.

6. PHP version in Tools > Configuration info is 8.2.35, 8.3.36, 8.4.27, 8.5.12 or higher (on distribution packages, check the package changelog for the CVE numbers).
7. Osclass version in Tools > Upgrade Osclass shows 8.4.0 or higher.
8. Post a test listing with photos, upload a profile picture and send a contact form with an attachment. If you added a temporary upload block, this tells you it is gone.
9. Open the Osclass debug log in backoffice and look for new PHP errors after the update.

What if I cannot update PHP today?

There is no complete workaround: updating PHP is the only fix. The PHP Foundation's advice is to update now. Sansec lists temporary mitigations that reduce exposure for a few hours, all with side effects:

• Set upload_progress.enabled = 0 in php.ini (or php_admin_flag in each PHP-FPM pool). Not sufficient on its own.
• Block multipart/form-data requests at the web server or WAF. This breaks image uploads in listings, profile pictures and contact form attachments, so your users cannot post ads with photos until you remove the rule.
• If you use Cloudflare or another WAF, enable its managed rules for the PHP2Shell CVEs.

Remove these workarounds once PHP is updated, and check that publishing a listing with photos works again.

What is CVE-2026-113381 in Osclass?

CVE-2026-113381 is an SQL injection in Osclass 8.3.1 and older, fixed in Osclass 8.4.0 (released 2 October 2026). Unlike PHP2Shell, this one is in Osclass code, so only an Osclass update closes it. The CVE was published around 20 October 2026, after the fix had already shipped.

• Where: the Item::findUserItems() method in oc-includes/osclass/model/Item.php.
• What: the search keyword (pattern) used when filtering a user's listings was not escaped before it went into the SQL query.
• Who can exploit it: remote visitors, no login needed. A proof-of-concept is public.
• Severity: CVSS 4.0 score 6.9 (medium) according to OpenCVE; some databases list CVSS 3.1 at 7.3.
• Possible impact: reading or changing database content such as listings, user e-mails and password hashes, depending on database user privileges.

The Osclass 8.4.0 changelog lists the fix as "Public profile listing search escapes the keyword and only allows known sort columns." In current code the pattern goes through the database escaping function before it reaches the query, and sort columns are limited to a known list.

How do I fix CVE-2026-113381?

Back up your site and update Osclass to 8.4.0 or newer.

10. Back up files and database (Tools > Backup data, or your hosting backup).
11. Update Osclass to 8.4.0 or newer. Get the package from the official Osclass download page or use Tools > Upgrade Osclass in backoffice. Read what else changed in Osclass 8.4 before you update a customised site.
12. Test the public profile page, search and posting on a staging copy first if you run a customised theme.
13. Check that themes and plugins are up to date as well, because they may call the same functions.

If you cannot update right away, add a WAF rule that blocks SQL keywords and quotes in the pattern parameter on public profile URLs. That buys time, nothing more.

PHP flaw vs Osclass flaw: who fixes what?

Server and PHP problems are fixed by your host or system administrator; Osclass core problems are fixed by an Osclass update; theme and plugin problems are fixed by their author. Knowing the layer tells you whom to contact and which update closes the hole.

Updating Osclass to 8.4 does nothing for PHP2Shell. Updating PHP does nothing for CVE-2026-113381. You need both.

What other security challenges hit classifieds sites in 2024-2026?

The main risks of the last two years were outdated PHP, hijacked third-party scripts, untrusted extensions, aggressive bots and attacks on user accounts. Classifieds sites are attractive targets because they hold e-mails, phone numbers and open forms that anyone can submit.

1. PHP versions reaching end of life

PHP 8.1 lost security support on 31 December 2025, and PHP 8.2 follows on 31 December 2026. Many Osclass sites still run on 7.4 or 8.0 because "it works". It works until the next PHP flaw, and then no upstream fix exists. PHP2Shell shows exactly that: branches 8.1 and older got no official release.

2. Old PHP holes still being exploited

CVE-2024-4577, a PHP-CGI argument injection on Windows servers disclosed in June 2024 (CVSS 9.8), was quickly used to spread ransomware and malware. Windows hosting with PHP-CGI and local stacks such as XAMPP left on public IPs were hit hardest. Lesson: old PHP bugs keep getting exploited for years on servers nobody updates.

3. Supply chain: third-party scripts and nulled extensions

In June 2024 the polyfill.io domain changed owner and started serving malicious JavaScript to sites that still loaded it; Sansec counted over 100,000 affected websites. The same logic applies to Osclass: every external script in your theme header runs with full access to your visitors' pages. Nulled themes and plugins are worse, since they often include backdoors from day one. Read how to download Osclass themes and plugins securely and only install packages from OsclassPoint or the original author.

4. Bots, AI crawlers and spam registrations

Automated traffic now outnumbers people on many sites. In our article on AI bots and AI traffic on classifieds sites we cite Cloudflare Radar data from June 2026 showing 57.5% of HTML requests coming from automation. For Osclass this means spam listings, fake accounts, contact form abuse and server load. Practical defences:

• Add Cloudflare Turnstile or Google reCAPTCHA Enterprise to registration, login, listing and contact forms. See how to set up Turnstile and reCAPTCHA Enterprise in Osclass.
• Require e-mail confirmation with the Email Verification plugin and turn on admin approval for new sellers.
• Use page caching to cut server load from bots and rate limits to keep the site fast for real users.

5. Session and account attacks

Cross-site scripting (XSS) that steals session cookies and cross-site request forgery (CSRF) that tricks a logged-in user into an action remain common on any site with user content. Weak admin passwords and shared admin accounts make every other defence weaker.

How has Osclass responded to these threats?

Osclass 8.3 and 8.4 added hardening in cookies, uploads, search, CSRF and HTML filtering. Security fixes ship only in the current 8.x line, so sites on 3.x, 4.x or unofficial forks receive none of them. Highlights from the official changelog:

• 3.0 (June 2025): stricter attachment checks and MIME validation on the item contact form, plus a plugin integrity check that flags plugins in an incorrect state. See the Osclass 8.3 release notes.
• 3.1 (January 2026): all cookies are set with httponly, so JavaScript cannot read them, cookie names are sanitised, and redirects after login no longer follow invalid saved URLs. Details in the 8.3.1 update guide.
• 4.0 (October 2026): escaped keyword and whitelisted sort columns in public profile search (the CVE-2026-113381 fix), CSRF token required for the public item statistics AJAX call, TinyMCE descriptions keep formatting but drop scripts and event handlers, stronger validation in the latest-searches feature, and comments can no longer be posted under another user's e-mail.
• 4.0 reports: the old GET-based "Mark as spam" links, which crawlers followed by accident, were replaced by a form for logged-in users. Background in why one-click Mark as flags stopped working.

Osclass security checklist for 2026

Start with the three urgent steps today, then run through the full list once a month.

In the next 60 minutes:

14. Check the PHP version in Tools > Configuration info.
15. Update PHP to a patched release, or ask your host to do it.
16. Back up and update Osclass to 8.4.0 or newer.

Every month:

17. Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer and restart PHP-FPM or Apache. Prefer PHP 8.4 or 8.5.
18. Update Osclass to the latest 8.x release (8.4.0 or newer) from the download page.
19. Update all themes and plugins, then deactivate and delete the ones you do not use.
20. Back up files and database every day and test a restore on staging at least once a month.
21. Use HTTPS and set WEB_PATH in php to the https URL.
22. Rename the admin folder with the OC_ADMIN_FOLDER constant and do not list it in robots.txt.
23. Give every admin a separate account with a strong unique password, and remove old accounts.
24. Lock file permissions: only oc-content/uploads, downloads and languages should be writable; make php read-only after installation.
25. Protect forms: add Cloudflare Turnstile to registration and listing forms or reCAPTCHA Enterprise, and require e-mail verification for new users and seller approval.
26. Review external scripts in your theme header and remove anything you no longer need.
27. Watch the logs with the debug log viewer in backoffice and your hosting access logs, looking for unusual POST requests, 500 errors and sudden traffic spikes.
28. Test updates on staging before production if you run custom code.

The full list of hardening options is on the official Osclass security page. For server limits such as PHP memory_limit, see which server limits break first on a growing classifieds site.

How do I report a security issue in Osclass?

E-mail info@osclass-classifieds.com with the subject "Security report". Include the Osclass version, the affected file, URL or admin screen, steps to reproduce and the possible impact. Say whether a theme or plugin is involved. Please do not post exploit details on forums, GitHub or social media before a fixed release is available. Issues in third-party extensions go to their authors.

Bottom line: PHP2Shell is fixed by updating PHP. CVE-2026-113381 is fixed by updating Osclass. Do both this week, keep backups, and protect your forms from bots. Need help? Browse Osclass security and anti-spam plugins or read the Osclass documentation.