What is PHP2Shell?
PHP2Shell groups two related memory-safety vulnerability classes in core PHP: CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2. Researchers demonstrated unauthenticated remote code execution and process-memory disclosure. PHP released fixes on 21 October 2026. The vulnerable component is the interpreter, rather than a particular plugin or CMS.
Which installations need attention?
PHP advises updating all installations serving Web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. WordPress, Drupal, Joomla, MediaWiki, Laravel and custom applications inherit the runtime risk. An application update alone does not replace PHP. Inventory embedded appliances, administrative interfaces, staging sites and containers as well as public production websites.
Is PHP-FPM exempt?
No. Exploitability differs by SAPI and by vulnerability. FPM terminates a child when request startup fails, preventing some demonstrated startup-only sequences. It does not eliminate application-level or cross-request state paths. Do not generalize the mod_php demonstration into identical exploitability everywhere, or use FPM as evidence that patching is unnecessary.
Distribution versions and backports
Ubuntu, Debian and enterprise Linux vendors often retain an older upstream number while adding security patches to a package revision. A banner such as 8.3.6 does not prove that a machine is vulnerable or fixed. Match the OS release, repository, architecture and installed revision to the vendor’s status for BOTH CVEs. This site deliberately does not invent package cutoffs.
PHP 8.1 and older
These branches receive no normal PHP project release. Minimal source backports were published for 7.4, 8.0 and 8.1 as an exceptional response; building and validating them is the operator’s responsibility. A distribution or LTS vendor may provide maintained packages. Research reports affected releases back to PHP 5.4, with different conditions per path. Migrate legacy runtimes to a supported branch and verify any interim vendor patch.
Temporary measures are incomplete
Only a complete patch addresses all covered variants. Configuration changes can reduce specific paths while you prepare an update, but may affect uploads, performance or availability. Apply them administratively before request parsing and restart every worker. Read both PHP advisories together. A CDN or WAF can reduce exposure but must not be treated as proof that the interpreter is fixed.
Patching does not rule out compromise
A version comparison cannot determine whether exploitation happened. Preserve relevant logs and image evidence before cleanup, investigate unexpected worker crashes, files, processes and outbound connections, and follow your incident-response process. Missing error messages are not evidence of safety. If compromise is suspected, isolate affected systems and rotate exposed secrets from a trusted environment after containing the incident.
How assessments are made
Manual checks compare full stable versions within the four published branches. Vendor builds need both CVE advisories; unknown builds stay unknown. The optional public website check collects reported versions and platform clues, never exploit proof. Missing headers, a CDN or one patched replica cannot establish safety for every runtime. Review dates describe editorial checks, not live threat intelligence.
Can a free scanner tell me whether I was hacked?
Not conclusively. Public headers can suggest a version, and local log rules can surface clues. Neither sees the full runtime, missing history or memory-only disclosure. Start with the guided inventory, preserve available evidence and correlate logs. If there are unauthorized accounts, unexpected processes or unexplained sensitive-data exposure, isolate and involve your host or incident team.
Was it an attempt, or a successful intrusion? →