PHP2Shell in plain language
PHP is the engine running your website; WordPress, Laravel and plugins sit above it. Updating a plugin does not update PHP. Two runtime memory-safety flaws can turn abnormal request cleanup into disclosure or code execution. A public website check can find clues, but only the host or server administrator can verify the actual Web runtime and its patch.
Find the PHP used by your website
WordPress: open Tools > Site Health > Info > Server and record the PHP version privately. A control panel: select the exact domain and its PHP handler, not the panel’s default. With SSH, compare php -v with the FPM or Apache service and container actually serving that domain. Different sites, command-line jobs and replicas can use different versions. Do not publish a phpinfo page.
Check my version →Ask your host for evidence, not reassurance
Please confirm whether the PHP Web runtime for my domain has fixes for BOTH CVE-2026-109618 and CVE-2026-109619. Please provide the full package/build revision, vendor advisory or changelog, and confirmation that every relevant FPM/Apache worker, container replica and long-running process was replaced or restarted. Also confirm whether you can review retained access, PHP and process logs for suspicious activity.Primary sources & further reading
PHP security teamRead the original ↗CVE-2026-109618Read the original ↗CVE-2026-109619Read the original ↗php2shell.ukRead the original ↗Research & practical guides
PHP2Shell tools
Check a public website, review local configuration and logs, or find maintained response tools. Each result explains its evidence and its limits.
01PHP2Shell in plain language
PHP is the engine running your website; WordPress, Laravel and plugins sit above it. Updating a plugin does not update PHP. Two runtime memory-safety flaws can turn abnormal request cleanup into disclosure or code execution. A public website check can find clues, but only the host or server administrator can verify the actual Web runtime and its patch.
02Was it an attempt, or a successful intrusion?
An unusual multipart request or a WAF alert can indicate an attempt. OOM messages, SIGSEGV/SIGABRT and bursts of HTTP 500 can also have ordinary causes. Unexpected PHP child processes, outbound connections, modified files or unauthorized accounts warrant urgent investigation, but attribution still needs evidence. Memory disclosure may leave no webshell or new file. A clean file scan cannot rule it out.
03Preserve evidence before changing the host
Record discovery time, domain, instance, runtime, current symptoms and the last known good state. Export original access/error/WAF and process logs with their timezone; preserve cloud audit records and authorized disk or memory snapshots when available. Store copies with restricted access and hashes. Do not upload cookies, tokens or customer data to public scanners. Avoid clearing logs or deleting suspicious files before evidence is captured.
04Reading Wiz and Calif without overgeneralizing
Wiz and Calif explain why request-lifecycle failures can outlive the request that caused them. The official advisory for CVE-2026-109618 demonstrates mod_php RCE; FPM susceptibility is source-based, without a complete demonstrated FPM exploit for that CVE. CVE-2026-109619 separately confirms an application-dependent FPM upload-progress path. Read each GHSA for its precise evidence instead of treating every SAPI as an identical proven exploit.
05Cloudflare: why response visibility matters
Cloudflare describes full-transaction detection using both request and origin response, allowing a matched response to be blocked before potential data leaves the proxy. This is useful for disclosure paths that do not launch a shell. The article’s rollout time is a historical snapshot, not a guarantee for your account: verify rule availability, routing, exclusions and event logs. Direct-origin paths and unproxied hosts still need patching and review.