Free security tool · CVE-2026-109618 · CVE-2026-109619

Is your server exposed to PHP2Shell?

PHP runs most of the web, and on 21 October its maintainers shipped emergency fixes for two flaws that let an attacker run code on an unpatched server without logging in. Check what your site announces, or paste the version from your server.

One ordinary request, the same as a browser visit. It reads what the server announces about PHP; it does not send any attack traffic. Check sites you own or look after.

Updated 2026-10-24 · by Asghar Ali

Fixed releases

Which PHP versions fix it.

These are the first fixed releases on each supported branch. Anything older on the same branch is affected.

BranchFixed inNotes
8.58.5.12Current release
8.48.4.27Supported
8.38.3.36Security fixes only
8.28.2.35End of life 31 Dec 2026
8.6 (pre-release)8.6.0 RC4Earlier 8.6 builds are affected
8.1 and olderNo official releaseSource backports for 7.4, 8.0, 8.1; vendor builds vary

What to do now

Six steps, in this order.

  1. 01

    Update PHP itself

    Move to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later (released 21 Oct 2026). The flaws are in the PHP runtime, so updating WordPress, Laravel or plugins does not fix them. Restart PHP-FPM and Apache afterwards so every worker runs the new build.

  2. 02

    Find the PHP you forgot about

    The old blog, an admin panel on a subdomain, a staging copy, a container image still pinned to an old php tag, a client site on shared hosting. Each one is a way in.

  3. 03

    On 8.1 or older, plan the move

    PHP 8.1 and earlier get no official release. The PHP team published source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors ship them. Upgrading to 8.4 or 8.5 is the lasting answer.

  4. 04

    Treat workarounds as temporary

    The PHP team says there is no complete mitigation: the configuration changes it lists reduce exposure on specific paths, and a WAF rule buys time. Neither makes an installation safe.

  5. 05

    If a public server stayed unpatched

    Read its access and error logs for the weeks before you patched, and rotate the secrets its PHP processes hold: one of the two flaws can disclose process memory, which is where database passwords and API keys live.

  6. 06

    Also set one line for CVE-2026-115560

    A related advisory (23 Oct) affects even the fixed releases in one narrow configuration. Until the next PHP release, session.upload_progress.enabled=0 closes it, and it is a recommended PHP2Shell mitigation anyway.

Beyond one CVE

AI found this bug. The same tools are pointed at your app.

PHP2Shell sat in PHP for years until an AI-assisted audit found a way to exploit it. Attackers have the same models. I review and test web and AI applications the way an attacker now would: source review, two-account authorisation tests, secrets and dependency checks, prompt-injection and tool-permission tests on LLM features, and a written fix list your team can act on.

Ask for a security review
The checklist I enforce

Questions

About PHP2Shell and this check.

What is PHP2Shell?
Two memory-safety flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. When a request ends abnormally (out of memory, a fatal error), PHP can leave memory in a state a later request can abuse. Exploited, they let an unauthenticated attacker run code on the web server, and one of them can read process memory.
Which PHP versions are affected?
PHP 5.4 and later, up to the fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35, and 8.6.0 RC4 for the development branch. PHP 8.1 and older receive no official fix.
Can this tool prove my site is safe?
No. It reads the version a server chooses to announce. Many servers hide it, and distribution builds often carry the fix under an older version number. The reliable check is the PHP build on the server itself, for every PHP process that serves traffic.
Is it legal to run this check?
The check makes one ordinary page request, the same as visiting the site in a browser, and sends no attack traffic. Use it on sites you own or look after.
How was PHP2Shell found?
Researchers at the security company Calif found it with help from an OpenAI model during an audit of PHP’s source code in August 2026, as the Wall Street Journal reported. Wiz and OpenAI researchers found further exploits. It is a clear example of AI-assisted vulnerability research, on both sides.

Sources