Update to the patched release for your branch and restart every worker. A patched package on disk does nothing until the running php-fpm, Apache mod_php, FrankenPHP or LiteSpeed workers are replaced. Confirm the version your web SAPI serves, not just the CLI, as the two are often different binaries.

My distro reports an old version number. Am I definitely vulnerable?

Not necessarily. Debian, Ubuntu and RHEL backport security fixes while keeping the upstream version string, so a distro box can report 8.3.34 and still carry the fix. Treat a version number as a strong signal and confirm against your vendor advisory or the running worker on the server.

PHP2Shell Checker

Is your PHP vulnerable to CVE-2026-109618 and CVE-2026-109619?

Two critical unauthenticated RCE bugs, patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Check any public URL in seconds.

Checking PHP version...

Reading response headers for a reported PHP version.

What PHP2Shell is

On 21 October 2026 the PHP project shipped an emergency release across every supported branch. It closes two separate vulnerabilities, both rated 9.2 critical, and both can lead to unauthenticated remote code execution. CVE-2026-109618 is an out-of-memory corruption bug; CVE-2026-109619 is a stale global state bug. The important properties are the same for both: no authentication required, and the trigger is in the runtime, not in your code.

Because it is a runtime vulnerability, it sits underneath every application level control you have. You can have perfect models, rate limited auth routes and a locked down config, and still be exposed purely because the PHP version serving the request is behind by one patch release.

Affected and fixed versions

Branch	Vulnerable below	Patched release
8.5	8.5.12	8.5.12
8.4	8.4.27	8.4.27
8.3	8.3.36	8.3.36
8.2	8.2.35	8.2.35

PHP 8.1 and older no longer receive fixes from the PHP project. Linux distributions backport fixes while keeping the upstream version string, so a distro box can report an old number and still be patched. This tool reports what the server advertises; confirm against your vendor advisory where it matters.

Frequently Asked Questions

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

A pair of critical PHP vulnerabilities disclosed on 21 October 2026, both rated 9.2 and both allowing unauthenticated remote code execution. One is an out-of-memory corruption bug, the other a stale global state bug. Both were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Which PHP versions are affected?

Any version below the patch for its branch: below 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer receive fixes, so those should be upgraded.

How do I fix it?

Update to the patched release for your branch and restart every worker. A patched package does nothing until php-fpm, Apache mod_php, FrankenPHP or LiteSpeed workers are replaced. Confirm the version your web SAPI serves, not just the CLI.

Is mod_php more at risk?

Yes. Apache with mod_php is the highest risk configuration, with a demonstrated path where a single unauthenticated request triggers the bug before any application code runs. Other SAPIs are affected too, but mod_php has the widest blast radius.

Does this tool exploit my site?

No. It sends a single standard HTTP request and reads the PHP version your server already advertises. It never sends an exploit payload. If your server hides its version, it will say so.