PHP2Shell is the name given to two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Both are rated CVSS 9.2 and allow unauthenticated remote code execution on any server that serves PHP over HTTP. They affect every PHP version from 5.4 to 8.5.11 and were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Which PHP versions are patched against CVE-2026-109618 and CVE-2026-109619?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later. PHP 8.1, 8.0 and 7.4 received source-only backports from the PHP security team and some Linux LTS vendors ship patched packages. PHP 7.3 and older get no fix at all.

How do I check if my server is vulnerable to PHP2Shell?

Run php-fpm -v or php -v on the server and compare the version with the fixed releases. From outside, a passive check reads the X-Powered-By and Server headers, but most servers hide the version, and Ubuntu or Red Hat packages may be patched without a version change, so the server-side check is authoritative.

Do I need to restart PHP after updating?

Yes. Restart PHP-FPM, Apache (mod_php), LiteSpeed, FrankenPHP and any long-running PHP workers. Processes started before the update keep running the vulnerable code.

What can I do if I cannot update PHP immediately?

Set memory_limit=-1 and a conservative post_max_size administratively, disable session.upload_progress, limit request size and multipart parts at the web server, and put a WAF in front. The PHP project states these reduce exposure but do not make an installation safe; updating is the only complete fix. CISA advises taking unsupported PHP 8.1-or-older systems offline until upgraded.

PHP2Shell Checker: Is Your PHP Patched?

What PHP2Shell is

On 20 October 2026 the details of two unreleased PHP core vulnerabilities leaked ahead of a coordinated disclosure. The PHP project shipped the fixes the next day, 21 October, as a security release across all four supported branches. Both bugs are rated CVSS 4.0 9.2 (Critical) and both allow unauthenticated remote code execution on a server that merely serves web requests — no application bug, no login, no plugin required.

CVE	Root cause	Advisory
CVE-2026-109618	Out-of-memory during request setup is handled with longjmp(), leaving half-initialised request memory that shutdown code later treats as valid. Triggerable with a crafted multipart POST inside normal size limits.	GHSA-w8hw-w9fx-j79w
CVE-2026-109619	Request-owned global state survives after its memory is freed, so a later request on the same worker reads stale data. Session upload progress is one confirmed path.	GHSA-6wmf-4rv5-p3rp

Every way of serving PHP over HTTP is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team demonstrated a full exploit against mod_php with default settings, firing before any application code runs. Cloudflare has already reported attack traffic aimed at these bugs, and CISA has issued an alert.

Fixed versions

Branch	Vulnerable	Fixed in	Status
8.5	8.5.0 – 8.5.11	8.5.12	Active support
8.4	8.4.0 – 8.4.26	8.4.27	Active support
8.3	8.3.0 – 8.3.35	8.3.36	Security fixes until 31 Dec 2027
8.2	8.2.0 – 8.2.34	8.2.35	Security fixes until 31 Dec 2026
7.4 · 8.0 · 8.1	all	source backports only	End of life. Minimal patches for building from source; some LTS vendors ship packages.
5.4 – 7.3	all	none	End of life. CISA: take these systems offline until upgraded.

PHP 8.6 release candidates were not patched at release time. If you test an 8.6 RC on anything reachable from the internet, treat it as vulnerable.

How this check works, and what it cannot see

The checker fetches the URL once, like a browser would, and reads the X-Powered-By and Server headers. If they carry a PHP version it is compared with the table above. If the version is hidden, the page body is fingerprinted for WordPress, Joomla, Drupal, Laravel and similar so you at least know PHP is there. That is the whole method: no exploit payload, no malformed multipart request, nothing that could crash a worker.

Given a bare IP address (IPv4 or IPv6, optional port), the checker goes to the origin directly: plain http first, then https with certificate validation skipped, since an IP never has a matching certificate. That bypasses whatever CDN or WAF sits in front of the domain and shows what the server itself advertises. Private and loopback ranges are refused.

Three limits are worth knowing:

Hidden versions. Most well-run servers set expose_php = Off and advertise nothing. The result is then "unknown" and only a check on the server itself can answer. That is why the box also accepts a version string.
Distribution backports. Ubuntu and Red Hat often fix a CVE without changing the version number, so an Ubuntu server advertising 8.3.6 may be fully patched. Debian 13 did bump to 8.4.27. When a distro name appears in the Server header the verdict is softened to "likely vulnerable" and you are pointed at the package changelog.
CDNs. When Cloudflare or another CDN fronts the site, the headers are the CDN's. The origin can still be unpatched. Enter the origin IP instead and the checker probes it directly.

Check on the server itself

The authoritative answer comes from the machine. Any of these takes a second:

# version of the CLI binary (may differ from the web SAPI!)
php -v

# the version the web server actually runs
php-fpm8.3 -v          # Debian/Ubuntu naming
php-fpm -v             # RHEL/Alma/Rocky

# Debian/Ubuntu: does the installed package carry the fix?
dpkg -s php8.3-common | grep Version
apt changelog php8.3-fpm 2>/dev/null | grep -m1 -i 'CVE-2026-109618'

# RHEL/Alma/Rocky/Fedora
rpm -q --changelog php | grep -m1 -i 'CVE-2026-109618'

# cPanel / Plesk: list every installed PHP, you may have several
ls /opt/cpanel/ | grep ea-php          # cPanel
ls /opt/plesk/php/                     # Plesk

A server frequently runs more than one PHP: the CLI, one or more FPM pools, a Plesk or cPanel multi-PHP tree, Docker images. Each one has to be at or above the fixed release.

How to update

Platform	Command / action
Debian / Ubuntu	sudo apt update && sudo apt install --only-upgrade 'php8.*' && sudo systemctl restart php8.3-fpm apache2
Ubuntu with ondrej PPA	sudo apt update && sudo apt upgrade && sudo systemctl restart 'php*-fpm'
RHEL / Alma / Rocky	sudo dnf update php\* && sudo systemctl restart php-fpm httpd
cPanel / WHM	WHM › EasyApache 4 › update, or /scripts/upcp --force; then restart Apache and PHP-FPM.
Plesk	Tools & Settings › Updates › install PHP updates (fixed packages were published for 8.2–8.5).
Docker	Rebuild from php:8.3.36-fpm (or 8.2.35 / 8.4.27 / 8.5.12) and redeploy. Pinned older tags stay vulnerable.
Shared hosting	Change the PHP version in the hosting panel to one at or above the fixed release, then ask the host to confirm the build date. SiteGround, GoDaddy and others patched fleet-wide on 21 October.

Restart everything that runs PHP after the update: PHP-FPM pools, Apache (mod_php), LiteSpeed, FrankenPHP, queue workers, Supervisor-managed daemons. A worker started before the update is still the old binary.

If you cannot patch within hours

The PHP project is explicit that these reduce exposure but do not make an installation safe. Set them where applications cannot override them (php_admin_value in the FPM pool or Apache config, never ini_set() or .user.ini), then restart every worker:

; CVE-2026-109618 — avoid the vulnerable out-of-memory path
memory_limit = -1
post_max_size = 8M        ; 32M if uploads are required; keep upload_max_filesize below it

; CVE-2026-109619 — close the confirmed stale-state path
session.upload_progress.enabled = 0
fatal_error_backtraces = 0  ; PHP 8.5 only

Enforce request size, field count, part count and header count at the web server or proxy; block multipart POSTs entirely if the application never uses them.
Use a container or cgroup memory limit as an availability boundary. Do not use RLIMIT_AS or RLIMIT_DATA; they trigger the vulnerable path.
Hiding errors with display_errors, error_reporting or @ does nothing here.
A WAF (Cloudflare has rules for the known vectors) buys time against copy-paste exploits, not against a tailored one.
Watch for PHP worker processes spawning shells or fetching tools; that is CISA's indicator of compromise for this one.

Other scanners

Pentest-Tools.com PHP2Shell scanner — free light scan, deeper scan on trial.
CyberRoute php2shell-scanner — open-source CLI that detects the vulnerable primitive without executing code; for systems you are authorised to test.
syhunt php2shell-protection — emergency Apache mitigation rules (multipart blocking, size limits).
Nessus / Tenable plugins 115719–115722 (web app) and 48243 (PHP version detection) for fleet-wide scans.

Related checks

PHP2Shell explained — what the two CVEs are, who is affected, and the step-by-step patch guide.
Security headers — including whether your server still leaks its software versions.
SSL/TLS inspector — certificate chain, expiry and protocol support.
Managed patching and hardening — if you would rather someone else did the 3 a.m. restart.

Sources: php.net security announcement, GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, CISA alert of 21 Oct 2026. Fixed-version table last verified 21 October 2026.

PHP2Shell Vulnerability Checker