PHP2Shell Checker
Check whether a website or PHP version is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the critical PHP remote code execution flaws patched on 21 October 2026.
Passive check • Address not storedEnter a website address or a PHP version to see whether PHP2Shell affects it.
Affected and fixed versions
| Branch | Affected | Fixed in | Support status |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 | Active support |
| PHP 8.4 | < 8.4.27 | 8.4.27 | Active support |
| PHP 8.3 | < 8.3.36 | 8.3.36 | Security fixes only |
| PHP 8.2 | < 8.2.35 | 8.2.35 | Security fixes only |
| PHP 8.1 and older | All releases | No official release. Source backports for 7.4, 8.0 and 8.1; some vendors ship backported packages. | End of life |
| PHP 8.6 | Builds before RC4 | 8.6.0 RC4 | Pre-release |
Source: PHP security advisory and GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, 21 October 2026.
This is a version check, not a vulnerability scan. It can't see vendor backports or interim mitigations, and a hidden version tells you nothing either way.
What the PHP2Shell Checker Does
- Enter a website address and it reads the PHP version from the site's X-Powered-By header
- Or enter a PHP version, or paste php -v output, to compare it with the fixed releases
- Tells you whether you're affected, which version to update to, and what to do if your PHP branch no longer gets updates
- Flags Linux distribution builds, which often get the fix without a version change
- Looks for signs of PHP (session cookies, WordPress, Drupal, Joomla) when a site hides its version
- Passive: at most two ordinary requests (the homepage, plus /wp-json/ for WordPress), no exploit traffic, and the address isn't stored
How to Check for PHP2Shell
- 1Enter your website address (for example example.com) or a PHP version such as 8.3.12, then click Check.
- 2For a website, the checker requests the homepage (for WordPress sites that hide it there, also the public /wp-json/ address) and reads the PHP version from the response headers.
- 3Read the verdict: not affected, affected with the version to update to, or no fixed release for your branch.
- 4If the site hides its version, run php -v on the server or check your hosting panel, then enter the version here.
- 5After updating, restart PHP and check again.
PHP2Shell Explained
PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the PHP project fixed on 21 October 2026. Both can let an attacker run code on a server without logging in, and both are rated 9.2 on CVSS v4.0.
What the two vulnerabilities are
CVE-2026-109618, RCE via OOM corruption: if PHP runs out of memory while internal request data is only partly initialized, request cleanup can treat that invalid data as valid. CVE-2026-109619, RCE via stale global state: state that belongs to one request can survive after its memory is freed, and a later request handled by the same worker can use it before normal initialization resets it. According to BleepingComputer, researchers from Calif, OpenAI and Wiz found the flaws.
Who is at risk
The PHP advisory says all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. So the CMS or framework you use doesn't matter; the PHP version your server runs does.
Affected and fixed versions
The GitHub advisories list every release below PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected, and those four releases contain the fixes. PHP 8.6.0 RC4 includes them too. PHP 8.1 and older get no new releases. Given the severity, the PHP team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP themselves, and some Linux distributions and LTS vendors provide backported packages.
How to fix it
Update to a fixed release. Linux distributions and LTS vendors received the patches in advance, so updated packages may already be available from your vendor. On shared hosting, switch to a fixed version in your control panel or ask your host whether they've installed the update. Restart PHP-FPM, Apache or your PHP workers afterwards so the new version is the one serving requests. If you're on PHP 8.1 or older, plan the move to a supported version; PHP 8.2 itself reaches end of life on 31 December 2026.
If you can't update right away
The advisory lists interim measures that reduce exposure to specific attack paths but don't make an installation safe. For CVE-2026-109618: set memory_limit=-1 in a way applications can't override (such as php_admin_value), use container or cgroup memory limits as the availability boundary, keep post_max_size low (8M without file uploads, 32M with them) with upload_max_filesize below it, and enforce request size and count limits at the web server or proxy. For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or the FPM pool (not with ini_set() or .user.ini) and restart every worker; on PHP 8.5, also set fatal_error_backtraces=0. Read the full list in the official advisory before changing production settings.
Is PHP2Shell being exploited?
The PHP team describes a demonstrated exploit against mod_php. BleepingComputer reported that Cloudflare's CTO saw early attacks targeting both vulnerabilities before the patches were released, and that the UK's National Cyber Security Centre urged organizations to update immediately or take affected systems offline. Reports differ on how widely the flaws are being exploited, so treat any unpatched server as at risk.
What this checker can and can't tell you
It compares a PHP version with the fixed releases. It doesn't test for the vulnerability or send exploit traffic, and it can't see whether your vendor backported the fix or whether interim mitigations are in place. Many websites hide their PHP version; a hidden version means you need to check on the server, not that you're safe.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. They can let an unauthenticated attacker run code on servers that use PHP to serve web requests. Both are rated 9.2 on CVSS v4.0.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026, fix both vulnerabilities. For the PHP 8.6 pre-release, 8.6.0 RC4 includes the fixes. Any earlier release in these branches is affected.
Is PHP 7.4 or 8.1 affected?
The PHP project no longer releases PHP 8.1 or older, so there's no fixed 7.4 or 8.1 version. Because of the severity, the PHP team published minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and LTS vendors ship backported packages. Unless your vendor confirms a backport, treat these versions as vulnerable and upgrade.
How do I check if my website is affected?
Enter your site's address in the checker above. If the site shows its PHP version, you'll see straight away whether it's affected. If the version is hidden, run php -v on the server, check your hosting control panel, or in WordPress go to Tools → Site Health → Info → Server, then enter the version here.
Does hiding the PHP version protect me?
No. Turning off expose_php or removing the X-Powered-By header only hides the version from outside checks like this one. The vulnerabilities are in PHP itself, so an unpatched server stays vulnerable.
Is WordPress affected by PHP2Shell?
WordPress isn't the vulnerable part; PHP is. Any WordPress site whose server runs an affected PHP version is at risk, whatever the WordPress version. Check your PHP version under Tools → Site Health → Info → Server, and ask your host to update PHP if it's affected.
I'm on shared hosting. What should I do?
Check which PHP versions your hosting control panel offers and switch to a fixed release if one is available. If not, contact your host and ask whether they've installed the PHP2Shell fixes.
Does this checker attack or scan my site?
No. It makes at most two ordinary requests, like a browser would: the homepage, plus the public /wp-json/ address for WordPress sites that hide the version on the homepage. It reads the response headers, doesn't send exploit traffic, and doesn't store the address.