Critical · CVSS 9.2

PHP2Shell Vulnerability Checker

On 21 October 2026 PHP released emergency fixes for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a server without logging in. Enter your site to see whether its PHP version is patched, or pick your version by hand.

Check a site now

Enter your site, a client's, or any site you are responsible for. It is read from the outside, one host. Nothing you enter is stored.

Already know your version? Check it by hand

Which PHP versions are fixed?

Update to the patched release of your branch, or any newer one. PHP 8.1 and older are end of life and got no release.

PHP branches and the release that fixes PHP2Shell
PHP branchFixed in
8.58.5.12
8.48.4.27
8.38.3.36
8.28.2.35
8.1 and olderNo release (end of life). Upgrade to 8.2.35 or newer, or use a vendor build that backports the fix.

How to fix it

  1. Find your exact PHP version. Use the checker above, your hosting panel, or run php -v on the server.
  2. Update PHP to the patched release. On managed hosting, switch the PHP version in the control panel or ask your host. On a server you manage, update the PHP packages from your distribution. With Docker, move to an image tag at or above the fixed version and rebuild.
  3. Re-check. Restart PHP-FPM or the web server, then run the check again. A site that pins an exact version in a Dockerfile or composer.json needs that pin changed, because a plain redeploy keeps the old version.
  4. Look for signs of compromise if you ran an affected version on the public internet: unexpected .php files in upload folders, and rotate secrets the application can read.

If you can't upgrade yet

Hosting provider Sevalla's advisory describes three PHP settings that make the attack harder but do not fix it. Treat them as a stopgap, not a patch, and note the side effects:

session.upload_progress.enabled = 0
memory_limit = -1
fatal_error_backtraces = 0

memory_limit = -1 removes the per-request memory cap, so one request can use all of the server's memory. Set these in php.ini or the PHP-FPM pool, not with ini_set(), and remove them after upgrading. Check the official PHP advisory before relying on them.

How this checker works

When you check a site, the server makes one normal request to the home page and reads the Server and X-Powered-By headers, where PHP often announces its version. If a version is there, it is compared with the last vulnerable release on that branch. If it's hidden, the tool looks for other signs of PHP and a CMS (such as WordPress or Laravel) and shows you how to find the exact version.

It never sends exploit code, never tests the flaw, and stores nothing. Only public domain names are accepted, and checks are rate limited.

Limits: headers can be hidden or changed, and Linux distributions sometimes backport a fix without changing the version number. A result is a version comparison, not a penetration test.

PHP2Shell FAQ

What is PHP2Shell?

PHP2Shell is the name used for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (critical) and let an attacker run code on a server with a crafted HTTP request, without signing in. PHP fixed them on 21 October 2026.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fix. Any newer patch release on those branches does too.

Is PHP 8.1 or older affected?

Yes. PHP 8.1 and older are end of life and PHP released no PHP2Shell update for them, only source-level backports. Upgrade to PHP 8.2.35 or newer, or ask your host or Linux distribution whether they ship a backport of the fix.

Does updating WordPress, Laravel or another framework fix it?

No. The flaws are in PHP itself, so the fix is a PHP update on the server, not a plugin or framework update.

What if the checker says my PHP version is hidden?

Many sites hide their PHP version, so no outside tool can read it. Find your exact version in your hosting panel (for example cPanel: Select PHP Version), in WordPress under Tools, Site Health, Info, Server, or with the one-file check on this page. Then enter it in the by-hand check.

Is the result a guarantee that my site is safe?

No. The checker compares a version number. Headers can be changed, and Linux distributions sometimes backport fixes without changing the version. It never sends exploit code and does not test the flaw itself.

Do you store the sites I check?

No. A check reads the public response headers and the start of the home page of the one host you enter, and returns the result. Nothing is saved.

Need a hand patching?

If you'd rather not touch the server yourself, I can help work out your PHP version and plan a safe update.

Email Abdullah Sheikh

Sources

Last updated .