# php2shellchecker.net

> Free, passive checker for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical PHP remote code execution flaws (CVSS v4.0 9.2) fixed on 21 October 2026. Built and operated by Globya Information Technologies (https://www.globya.com.tr), a web hosting and software company. Support is offered through https://www.globya.com.tr/iletisim.

Facts last verified: 2026-10-23. Primary source: php.net security advisory of 21 October 2026.

## Fixed versions (php.net)

- PHP 8.5.x: fixed in 8.5.12 (anything lower in the 8.5 branch is affected)
- PHP 8.4.x: fixed in 8.4.27 (anything lower in the 8.4 branch is affected)
- PHP 8.3.x: fixed in 8.3.36 (anything lower in the 8.3 branch is affected)
- PHP 8.2.x: fixed in 8.2.35 (anything lower in the 8.2 branch is affected)
- PHP 8.1 and older: end of life, no official release from the PHP project. Minimal source backports exist for 7.4, 8.0 and 8.1; Linux distributions may ship backported fixes under old version numbers.

## Key points

- Affects PHP serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed. Risk is highest for mod_php (unauthenticated exploit demonstrated).
- Impact: unauthenticated remote code execution, and (CVE-2026-109619) disclosure of PHP process memory — passwords, session tokens, API keys — without code execution. Exposed sites should rotate secrets.
- Researchers (Wiz Research, OpenAI Codex Security, Calif) demonstrated attacks on WordPress, Drupal and Joomla; no specific application is required. Research site: https://www.php2shell.com/
- After patching: the fix adds a hard memory limit that terminates the process (shutdown handlers do not run).
- php.net: "There are no complete mitigations, updating is the only safe choice."
- Partial mitigations (php.net / GHSA): session.upload_progress.enabled=0 in php.ini or pool config, fatal_error_backtraces=0 on 8.5, post_max_size 8M, memory limits; restart all workers.
- A remote check can only read version banners (X-Powered-By / Server). Hidden banners and distro backports mean "unknown" is common; verify on the server with `php -v` and the package changelog.

## Pages

- [Checker and summary](https://php2shellchecker.net/en/)
- [How to fix: per platform, restart, verify, signs of compromise](https://php2shellchecker.net/en/guide/)
- [Frequently asked questions](https://php2shellchecker.net/en/faq/)
- [Method, what the checker sends, operator](https://php2shellchecker.net/en/about/)
- [Privacy: what is stored and for how long](https://php2shellchecker.net/en/privacy/)

Available in 19 languages: https://php2shellchecker.net/en/, https://php2shellchecker.net/zh/, https://php2shellchecker.net/de/, https://php2shellchecker.net/fr/, https://php2shellchecker.net/es/, https://php2shellchecker.net/pt-br/, https://php2shellchecker.net/ru/, https://php2shellchecker.net/ja/, https://php2shellchecker.net/ko/, https://php2shellchecker.net/it/, https://php2shellchecker.net/nl/, https://php2shellchecker.net/pl/, https://php2shellchecker.net/tr/, https://php2shellchecker.net/id/, https://php2shellchecker.net/vi/, https://php2shellchecker.net/ar/, https://php2shellchecker.net/hi/, https://php2shellchecker.net/uk/, https://php2shellchecker.net/da/

## API

- [Version table as JSON](https://php2shellchecker.net/api/v1/versions.json)

## References

- [php.net news archive 2026](https://www.php.net/archive/2026.php)
- [PHP 8 ChangeLog](https://www.php.net/ChangeLog-8.php)
- [GHSA-w8hw-w9fx-j79w (CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- [GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [Supported PHP versions](https://www.php.net/supported-versions.php)
- [php2shell.com — research team (Wiz Research, OpenAI, Calif)](https://www.php2shell.com/)
- [The PHP Foundation — release post](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)