PHP2Shell Checker: CVE-2026-109618 and CVE-2026-109619
PHP2Shell is the name used for two critical PHP vulnerabilities patched on 21 October 2026. This page explains which releases are affected, which versions contain the official fix, and how to check whether a public site is exposing a vulnerable PHP version.
Based on the official php.net advisory. This page contains no exploitation instructions.
Free checker
Check a website for PHP2Shell
Enter a public URL. The checker reads the PHP version a site exposes, compares it with the first official fixed release in its branch, and marks distribution builds it cannot verify.
Free · No sign-up · We never store the URLs you check
The advisory
What is PHP2Shell?
PHP2Shell is the name used for two critical vulnerabilities in the PHP runtime. Both were fixed by the PHP project on 21 October 2026. They matter because PHP is the layer that runs the application: a vulnerable PHP worker can be attacked before WordPress, Laravel, or any other application code runs.
The pre-release notice rated the pair CVSS v4.0 9.2 (Critical). PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes. Every earlier release in those branches is affected. The official advisory considers mod_php the highest-risk setup, but PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed installations are also in scope.
Remote code execution via out-of-memory corruption
A PHP runtime flaw that can allow unauthenticated remote code execution in affected configurations. The official advisory has the technical details.
Official advisoryRemote code execution via stale global state
A PHP runtime flaw that can allow unauthenticated remote code execution in affected configurations. The official advisory has the technical details.
Official advisoryAffected versions
Which PHP versions are affected?
The official fixes cover PHP 8.2 through 8.5. If a site runs an earlier release in one of these branches, the checker marks it vulnerable. PHP 8.1 and older are end of life and have no supported release.
Swipe horizontally to see all columns.
| PHP branch | Affected releases | First fixed release | Branch support |
|---|---|---|---|
| 8.5 | 8.5.0–8.5.11 | 8.5.12 | Active support Security support until Dec 31, 2029 |
| 8.4 | 8.4.0–8.4.26 | 8.4.27 | Active support Security support until Dec 31, 2028 |
| 8.3 | 8.3.0–8.3.35 | 8.3.36 | Security fixes only Security fixes until Dec 31, 2027 |
| 8.2 | 8.2.0–8.2.34 | 8.2.35 | Security fixes only Security fixes until Dec 31, 2026 |
Remediation
What to do now
Updating is the only complete fix. The official advisory also lists temporary mitigations for cases where an immediate update is impossible. Follow those instructions on php.net rather than relying on an application-level filter.
- 1
Update PHP
Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you use managed hosting, ask the host to apply the security update or use its PHP version selector.
- 2
Restart every PHP worker
Restart PHP-FPM, Apache with mod_php, containers, and any other PHP worker. Replacing files on disk without restarting can leave the old, vulnerable binary in memory.
- 3
Verify the web SAPI
Check PHP_VERSION through the web server, not only with php -v. The CLI build and the FPM/Apache build can be different. The checker's self-check panel lists quick ways to verify the web version.
- 4
Check vendor packages
On a Linux distribution or LTS vendor, the fix may be backported without changing the version number. Check the vendor's advisory. The checker reports distribution-suffixed versions as cannot determine.
How it works
How this checker judges PHP2Shell exposure
The checker reads the public X-Powered-By and Server headers, extracts a PHP version when one is present, and compares it with the first fixed release for that branch. It also recognises PHPSESSID cookies and WordPress generator tags, which can show that PHP is in use even when the version is hidden.
If the version is below the fixed release, the result is vulnerable. If it is at or above, the result is patched. If the site hides the version or uses a distribution suffix, the result is cannot determine.
This is a passive check. The checker sends ordinary HEAD and GET requests to public pages, just like a browser or a crawler. It does not send POST requests, try to log in, or probe for vulnerabilities.
What the checker cannot see
- A PHP version hidden by expose_php or a CDN.
- A distribution backport that did not change the version string.
- Whether the web SAPI or the CLI binary is the updated one.
- Whether PHP-FPM or Apache workers were restarted after the update.
Does this affect WordPress?
Yes, if WordPress runs on an affected PHP version. PHP2Shell is a PHP runtime vulnerability, not a WordPress plugin or theme issue. Updating WordPress, a security plugin, or a web application firewall does not replace the PHP fix. Update the PHP binary and restart the PHP workers.
On shared hosting, open the host's PHP version selector and choose a patched release. Then verify the front-end PHP version with the checker or WordPress Site Health. A host that offers only an end-of-life branch is a reason to move to a supported plan.
FAQ
PHP2Shell questions
Short answers for site owners and hosting teams. The official advisory remains the authoritative source.
Official references
- PHP security advisory (php.net)
- PHP 2026 release archive (php.net)
- GHSA-w8hw-w9fx-j79w
- GHSA-6wmf-4rv5-p3rp
- PHP lifecycle data (endoflife.date)
This page summarizes the official advisory for site owners. It does not contain exploitation instructions and is not a security audit. A patched PHP version does not by itself prove that a site is secure.
Check another site
The checker is free and does not require an account.