php2shell checkerCVE-2026-109618 · CVE-2026-109619
- threatunauthenticated remote code execution in PHP itself
- affectsWordPress · Laravel · Drupal · Joomla · custom PHP
- patched8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 // 8.1 and older: no upstream fix
01 Scan a website
// read-only: public headers + 5 common phpinfo() paths · no exploit payloads · nothing stored
A remote scan reports the PHP version a site reveals. It can't see distro backports or signs of an attack, and can't prove a site is safe: for that, run the server check below.
02 Fixed PHP versions
| Branch | Patched in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No upstream fix. Upgrade to 8.2+ or use a vendor backport. |
Source: php.net, advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
03 Check from the command line
[server] On your server: the most accurate check
Finds every PHP build (CLI, FPM, mod_php, LiteSpeed, FrankenPHP, cPanel, Plesk, Docker), confirms distro backports, and looks for web shells and other signs of compromise. Read-only.
curl -fsSL https://raw.githubusercontent.com/arifulislamat/php2shell-audit/main/check.sh | sudo bash
[remote] From your computer, against a site
The same checks as the scanner above, from your own terminal.
curl -fsSL https://raw.githubusercontent.com/arifulislamat/php2shell-audit/main/check.sh | bash -s -- https://example.com
Shared hosting with no SSH? In WordPress, open Tools → Site Health → Info → Server to see the PHP version, or ask your host.
04 FAQ
What is php2shell?
php2shell is the name for CVE-2026-109618 and CVE-2026-109619, an unauthenticated remote code execution flaw in PHP itself. Any site running a vulnerable PHP version is affected: WordPress, Laravel, Drupal, Joomla and custom PHP alike.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no upstream fix: upgrade to 8.2 or newer, or use a vendor backport such as Ubuntu Pro, Debian LTS or CloudLinux.
Does updating WordPress, Laravel or plugins fix php2shell?
No. The flaw is in the PHP runtime, so only updating PHP fixes it. After updating, restart PHP-FPM, Apache or LiteSpeed, otherwise the old code keeps running.
My server still shows an old PHP version number. Am I vulnerable?
Not necessarily. Ubuntu, Debian and RHEL often backport the fix without changing the version number. The server check reads the package changelog to confirm the backport.
How do I check my PHP version without SSH?
Scan the site on this page, or in WordPress open Tools → Site Health → Info → Server to see the PHP version. On managed hosting, ask your host whether your PHP includes the fixes for CVE-2026-109618 and CVE-2026-109619.
I can't patch yet. How do I reduce the risk?
In
php.ini or the PHP-FPM pool (not ini_set() or .user.ini) set session.upload_progress.enabled = 0, plus fatal_error_backtraces = 0 on PHP 8.5. For CVE-2026-109618, set a non-overridable memory_limit = -1 with container or cgroup memory limits, and post_max_size = 8M. Restart all PHP workers and keep your WAF on. This reduces exposure but is not a fix.Is a WAF such as Cloudflare enough?
No. A WAF can reduce exposure, but it is a mitigation, not a fix. Update PHP as well.
Is the php2shell checker safe to run?
Yes. It is read-only: remote checks send ordinary GET requests to a few public paths, and the server check only reads files, processes and logs. It sends no exploit payloads and changes nothing. The source code is on GitHub under the MIT license.