<?php Independent PHP security check
Is your PHP affected by PHP2Shell?
Two critical flaws in PHP itself allow remote code execution. They were fixed on 21 October 2026. Check what a website reveals about its PHP version, or paste a version string — then see exactly what to do.
- Passive: one ordinary request, no exploit
- Free, no sign-up, no ads
- Based on php.net and the official advisories
2Check a version
Evaluated in your browser — nothing is sent to us. One version per line, up to 20.
01 · php.net · 2026-10-23
Fixed versions
| Branch | Fixed in | Branch status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Actively supported |
| PHP 8.4 | 8.4.27 | Actively supported |
| PHP 8.3 | 8.3.36 | Security fixes only |
| PHP 8.2 | 8.2.35 | Security fixes only — end of life on 31 Dec 2026 |
| PHP 8.1 · 8.0 · 7.x · 5.x | No official release | End of life — no release from the PHP project |
Source: php.net security advisory, 21 October 2026. Last verified 2026-10-23.
What is PHP2Shell?
PHP2Shell is the name researchers gave to two vulnerabilities in the PHP engine: CVE-2026-109618 (memory corruption when PHP runs out of memory while parsing a request) and CVE-2026-109619 (internal state that survives from one request to the next on the same worker). Both are rated CVSS v4.0 9.2.
An unauthenticated attacker can execute code on the server or read PHP process memory — including passwords, session tokens, API keys and certificates belonging to other requests — without running any code at all. According to php.net they affect PHP serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The researchers demonstrated attacks on WordPress, Drupal and Joomla, but no specific application is required: even a simple “Hello World” page on an affected PHP is exposed.
What to do now
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — or your distribution’s patched package.
- Restart every PHP process: PHP-FPM, Apache, queue workers, containers. An update is not active until then.
- Check every PHP on the server — panels often install several versions side by side.
02 · shell
Check on the server itself
A website check only sees what the server chooses to reveal. On the server, these commands give the real answer:
# version of the default PHP
php -v
# other PHP versions installed by panels or packages
ls -d /usr/bin/php* /usr/sbin/php-fpm* /opt/alt/php*/usr/bin/php /opt/cpanel/ea-php*/root/usr/bin/php /opt/plesk/php/*/bin/php 2>/dev/null
# settings related to the partial mitigations
php -i | grep -E 'session.upload_progress.enabled|post_max_size|memory_limit|fatal_error_backtraces'
# what your site reveals to visitors
curl -sI https://your-site.com/ | grep -i -E '^(x-powered-by|server):'03 · FAQ
Common questions
Which PHP versions are affected?
Every version before 8.5.12, 8.4.27, 8.3.36 and 8.2.35 in the supported branches. PHP 8.1 and older are end of life and receive no release from the PHP project; treat them as affected unless your vendor confirms a backported fix.
My site does not show a PHP version. Am I safe?
Not necessarily. Hiding the version (expose_php = Off) is good practice but does not patch anything. Check on the server with php -v or ask your provider.
The checker shows an old version, but my host says it is patched. Who is right?
Possibly both. Linux distributions such as Debian, Ubuntu and RHEL often backport security fixes without changing the version number. Ask your host which package build is installed and whether its changelog mentions CVE-2026-109618 and CVE-2026-109619.
Is WordPress, Laravel or my CMS affected?
The flaws are in PHP itself, so any application running on an affected PHP is exposed. The researchers demonstrated unauthenticated attacks on WordPress, Drupal and Joomla, but those were only examples — even a plain “Hello World” page is enough. Updating WordPress or plugins does not fix it; PHP must be updated.
Can data leak even if no code was executed?
Yes. CVE-2026-109619 can disclose PHP process memory — passwords, session tokens, API keys and certificates from other requests — without the attacker running code. Such leaks leave no files behind and are hard to detect, so change the secrets of any site that ran an affected version on the internet.