PHP security update available/Read the official advisory
PHP2ShellChecker
English
Language
English✓简体中文DeutschFrançaisEspañolPortuguês (Brasil)Русский日本語한국어ItalianoNederlandsPolskiTürkçeBahasa IndonesiaTiếng Việtالعربيةहिन्दीУкраїнська
Menu

INDEPENDENT PHP SECURITY TOOLKIT

Check your PHP.Patch with confidence.

A clear answer starts with the right version. Check your PHP2Shell patch threshold, understand the result, and find the next step for your environment.

Check my versionNot sure which PHP you use?

Private by design. Your input stays in this browser.

PHP is the best language in the world

9.2/10Critical severityCVSS v4.0
02Related vulnerabilitiesCVE-2026-109618 / 109619
04Patched branchesPHP 8.2 → 8.5
18LanguagesEN / 中文 / 日本語 / …

01 / CHECK YOUR EXPOSURE

One version. Or your whole fleet.

Paste a PHP version, php -v output, or one version per line. This compares versions; it does not test exploitation.

PHP2SHELL / Checker

Private by design. Your input stays in this browser.

PHP2SHELL / FRAMEWORK / CMS

PHP2Shell fixes for frameworks & CMS

Fix PHP2Shell on your framework, blog or store. Identify the running PHP, check application compatibility, resolve upgrade blockers and verify both CVE-2026-109618 and CVE-2026-109619 fixes.

Laravel ↗ThinkPHP ↗WordPress ↗PHPCMS ↗DedeCMS ↗WooCommerce ↗All applications ↗

PHP2SHELL / PHP2Shell tools

Research & practical guides

Check a public website, review local configuration and logs, or find maintained response tools. Each result explains its evidence and its limits.

>_

PHP2Shell tools

Check a public website, review local configuration and logs, or find maintained response tools. Each result explains its evidence and its limits.

01

PHP2Shell in plain language

PHP is the engine running your website; WordPress, Laravel and plugins sit above it. Updating a plugin does not update PHP. Two runtime memory-safety flaws can turn abnormal request cleanup into disclosure or code execution. A public website check can find clues, but only the host or server administrator can verify the actual Web runtime and its patch.

02

Was it an attempt, or a successful intrusion?

An unusual multipart request or a WAF alert can indicate an attempt. OOM messages, SIGSEGV/SIGABRT and bursts of HTTP 500 can also have ordinary causes. Unexpected PHP child processes, outbound connections, modified files or unauthorized accounts warrant urgent investigation, but attribution still needs evidence. Memory disclosure may leave no webshell or new file. A clean file scan cannot rule it out.

03

Preserve evidence before changing the host

Record discovery time, domain, instance, runtime, current symptoms and the last known good state. Export original access/error/WAF and process logs with their timezone; preserve cloud audit records and authorized disk or memory snapshots when available. Store copies with restricted access and hashes. Do not upload cookies, tokens or customer data to public scanners. Avoid clearing logs or deleting suspicious files before evidence is captured.

04

Reading Wiz and Calif without overgeneralizing

Wiz and Calif explain why request-lifecycle failures can outlive the request that caused them. The official advisory for CVE-2026-109618 demonstrates mod_php RCE; FPM susceptibility is source-based, without a complete demonstrated FPM exploit for that CVE. CVE-2026-109619 separately confirms an application-dependent FPM upload-progress path. Read each GHSA for its precise evidence instead of treating every SAPI as an identical proven exploit.

05

Cloudflare: why response visibility matters

Cloudflare describes full-transaction detection using both request and origin response, allowing a matched response to be blocked before potential data leaves the proxy. This is useful for disclosure paths that do not launch a shell. The article’s rollout time is a historical snapshot, not a guarantee for your account: verify rule availability, routing, exclusions and event logs. Direct-origin paths and unproxied hosts still need patching and review.

02 / THE PATCH BASELINE

Four branches. A clear upgrade target.

Published by the PHP security team on 21 October 2026. Compare within your own branch.
PHP.net ↗

Four branches. A clear upgrade target.
PHP branchUpstream releases belowFirst patched releaseSecurity support ends
PHP 8.5< 8.5.12✓ 8.5.12Dec 31, 2029
PHP 8.4< 8.4.27✓ 8.4.27Dec 31, 2028
PHP 8.3< 8.3.36✓ 8.3.36Dec 31, 2027
PHP 8.2< 8.2.35✓ 8.2.35Dec 31, 2026
Running PHP 8.1 or older?

No normal PHP project release is available for these branches. Minimal source backports exist for 7.4, 8.0 and 8.1; vendor support must be verified separately. Read guide ↗

03 / FROM CHECK TO FIX

A practical path back to work.

Explore the repair guide ↗
01

Identify

Find every PHP runtime, package source and per-site handler.

02

Update

Install the patched build or a documented vendor backport.

03

Restart & verify

Replace running workers and verify every instance.

Ubuntu & Debian

Identify the installed php*-common package and the Web handler’s package, then consult the Ubuntu or Debian security tracker for both CVEs.

Read guide

RHEL, Rocky, AlmaLinux & related systems

Identify whether the runtime is provided by the OS, an application stream or a third-party repository.

Read guide

Docker & container images

A restart of the same container does not install a PHP patch.

Read guide

BaoTa & 1Panel

Panel PHP installations can be independent of system PHP.

Read guide

WordPress, shared hosting & managed services

Updating WordPress, Drupal or Joomla does not update the PHP interpreter.

Read guide

PHP2Shell fixes for frameworks & CMS ↗

PHP2SHELL / CVE

Two bugs in the runtime. One urgent update.

PHP2Shell is a family of memory-safety flaws in PHP itself. A fully updated application can still run on an unpatched interpreter.

CVE-2026-109618CVSS 9.2

Out-of-memory corruption

CVE-2026-109618 concerns PHP’s early exit during an out-of-memory condition. Partly initialized request memory can remain reachable and later be consumed during cleanup. The patch replaces the unsafe OOM exit pattern with soft and hard memory handling. Complete unauthenticated RCE was validated against mod_php. The official advisory considers FPM susceptible to application-specific paths, but does not claim a complete FPM exploit for this CVE.

Read guide ↗
CVE-2026-109619CVSS 9.2

Stale state across requests

CVE-2026-109619 concerns request-owned memory referenced by persistent worker state after that memory is freed. A later request reaching the same worker can consume the stale value before normal initialization resets it. Confirmed paths include fatal-error backtraces in PHP 8.5 and session upload-progress lifecycle handling. RCE was validated with mod_php and, through a suitable application path, PHP-FPM.

Read guide ↗
Primary sources & further readingPHP security team ↗PHP2Shell research ↗

FAQ

Questions, answered.

All questions ↗
Is PHP-FPM exempt?

No. Exploitability differs by SAPI and by vulnerability. FPM terminates a child when request startup fails, preventing some demonstrated startup-only sequences. It does not eliminate application-level or cross-request state paths. Do not generalize the mod_php demonstration into identical exploitability everywhere, or use FPM as evidence that patching is unnecessary.

Distribution versions and backports

Ubuntu, Debian and enterprise Linux vendors often retain an older upstream number while adding security patches to a package revision. A banner such as 8.3.6 does not prove that a machine is vulnerable or fixed. Match the OS release, repository, architecture and installed revision to the vendor’s status for BOTH CVEs. This site deliberately does not invent package cutoffs.

PHP 8.1 and older

These branches receive no normal PHP project release. Minimal source backports were published for 7.4, 8.0 and 8.1 as an exceptional response; building and validating them is the operator’s responsibility. A distribution or LTS vendor may provide maintained packages. Research reports affected releases back to PHP 5.4, with different conditions per path. Migrate legacy runtimes to a supported branch and verify any interim vendor patch.

Temporary measures are incomplete

Only a complete patch addresses all covered variants. Configuration changes can reduce specific paths while you prepare an update, but may affect uploads, performance or availability. Apply them administratively before request parsing and restart every worker. Read both PHP advisories together. A CDN or WAF can reduce exposure but must not be treated as proof that the interpreter is fixed.

PHP2SHELL CHECKER

The next step is a patched runtime.

Start with your version. Follow the evidence. Verify the workers that actually serve your site.

Check my version