PHP2Shell Checker

Check whether your website is exposed to PHP2Shell — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 Critical).

What is PHP2Shell?

PHP2Shell is the community name for two remote code execution flaws patched by the PHP project on 21 October 2026. Both are rated CVSS v4.0 9.2 (Critical) and both affect any PHP installation that handles web requests.

Affected SAPIs: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk because it can be triggered before application code runs.

Fixed versions

If your version string carries a distribution suffix such as 8.3.6-1ubuntu1.2, compare the upstream number and also check your distribution security advisory — vendors frequently backport fixes without changing the upstream version string.

Three self-check steps

1. Read your PHP version. On the server, or over SSH:

php -v

If you cannot reach a shell, look at your hosting control panel (cPanel, Plesk, or a panel such as BaoTa) — the installed PHP version is listed there, often per domain.

2. Read the public response header. Many sites expose the version without knowing it:

curl -I https://yourdomain.com | grep -i powered

If it returns X-Powered-By: PHP/8.3.6, that version is public. Note that hiding the header does not make you safe — it only means the version cannot be read from outside. You still have to check the server itself.

3. Ask your host if you do not manage the server. Copy this:

Hello, I am the owner of DOMAIN. Please confirm which PHP version
this site runs (PHP-FPM, mod_php, php-cgi, FrankenPHP or LiteSpeed),
and whether it has been updated to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
for CVE-2026-109618 and CVE-2026-109619. If the site runs PHP 8.1 or
earlier, please tell me which fixed build is available and when.
Thank you.

Mitigations until you can upgrade

For CVE-2026-109618: set memory_limit=-1 through php_admin_value so application code cannot override it; tighten post_max_size (8M for sites without uploads, 32M with) and keep upload_max_filesize below it; cap decoded request body size, field count, multipart part count, header count and nesting depth at the web server or proxy layer, including requests without a Content-Length header; use container or cgroup limits as an availability boundary, and do not use RLIMIT_AS or RLIMIT_DATA.

For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini, the FPM pool config or the server config — not through ini_set() or .user.ini — and restart every worker. On PHP 8.5 also set fatal_error_backtraces=0 and restart workers. This blocks the confirmed session paths but not other variants, and it covers only one of the two CVEs.

Frequently asked questions

How do I know if my site runs PHP at all? A response header of X-Powered-By: PHP/..., a PHPSESSID cookie, or .php URLs in the page all indicate PHP. Most WordPress, Drupal and Magento installs run PHP even when nothing in the URL says so.

My version is hidden — am I safe? No. A hidden version means the version cannot be read from outside, not that it is patched. Treat it as unknown and check the server directly.

I run PHP 8.1 or older. Is there a fix? Not from the PHP project itself — those branches are out of security support. Source-level backports are published for 7.4, 8.0 and 8.1, and distribution vendors or LTS providers may ship their own fixed builds. Ask your host which fixed build they provide.

Is 8.2 safe long term? PHP 8.2.35 contains the fix, but the 8.2 branch reaches end of life on 31 December 2026. Plan the move to 8.3 or later.

Does this site scan my server? No. This tool reads publicly available response headers only — the same information any browser receives. It never sends POST requests, uploads or malformed payloads, and it never performs intrusive testing.