CVE-2026-109618 · CVE-2026-109619

PHP2Shell Checker — is your website affected?

Two critical vulnerabilities in PHP itself let an attacker run code on a server with a single web request — no login needed. Enter your address for a free, instant check of the PHP version your server reports.

Normal browser requests only
No sign-up
Results in seconds

Background

What is PHP2Shell?

PHP2Shell is the name for two flaws in the PHP engine itself — not in WordPress or any plugin. One corrupts memory when a request runs PHP out of memory mid-upload; the other reuses freed memory from a previous request. Both are fixed in the PHP releases listed below.

Because the flaw sits in PHP, it affects WordPress, Drupal, Joomla and custom PHP sites alike — and security plugins can’t fully block it. Updating PHP is the only complete fix.

Am I affected?

Fixed versions

Your PHP is patched if it is at or above the fixed release for its branch:

Your PHP branch	Update to at least	Security support until
8.5.x	8.5.12	Dec 31, 2029
8.4.x	8.4.27	Dec 31, 2028
8.3.x	8.3.36	Dec 31, 2027
8.2.x	8.2.35	Dec 31, 2026
older than 8.2	No fix exists — upgrade the branch to 8.2 or newer

On PHP 8.2? Patching to 8.2.35 closes PHP2Shell, but 8.2 stops receiving security fixes on Dec 31, 2026. If you’re updating anyway, move to 8.4.

Result says “Unknown”?

Check your PHP version yourself

Many servers hide their PHP version from the outside — good practice, but it means a remote check can’t judge it. Any of these will tell you in a minute:

Your hosting panel

Look for “PHP version”, “PHP Configuration” or “MultiPHP Manager”. This is the version your website actually runs — the most reliable answer.

A temporary phpinfo file

Upload a file named info.php containing <?php phpinfo(); to your site, open it in a browser, and read the version at the top. Delete it straight after — it reveals server details.

SSH

Run php -v. Note this shows the command-line PHP, which can differ from the version serving your website — confirm in the hosting panel.

Then compare it with the fixed versions table.

Next steps

My result says vulnerable — what do I do?

1
Don’t panic, but don’t wait. Public details make attacks more likely, so treat this as urgent.
2
Update PHP. On most hosts this is a setting in your hosting panel (look for “PHP version” or “MultiPHP Manager”) — pick 8.4 if offered. Take a site backup first if your host offers one.
3
Stuck on 8.1 or older? Ask your host two things: have they backported the PHP2Shell fixes, and can they move you to PHP 8.4?
4
Rather have it done for you? Our flat-rate update service handles the PHP upgrade and checks your site still works afterwards. Run the check above, then request a free quote from your results page.

Backports

“My host says they patched it.”

Some hosts and Linux distributions backport security fixes without changing the version number, so your server can report an old version and still be patched. Our check reads the version your server publishes — if your host confirms in writing that they backported CVE-2026-109618 / CVE-2026-109619, you’re covered. If they can’t confirm, treat the result as real.

FAQ

PHP2Shell questions

Can this checker tell for sure?

It reads the same version info your server shows the whole internet. If your server hides its version — which is good practice — the result is “Unknown”; use one of the three self-checks above to find it.

Is checking my site safe?

Yes — only normal browser-style requests and a TLS handshake. No exploit traffic, ever.

Does a plugin or firewall protect me instead?

A web application firewall can block known attack patterns, which helps, but the vulnerabilities are in PHP itself. Updating PHP is the only complete fix.

I’m not on WordPress — does this apply to me?

Yes. Any site running PHP — Drupal, Joomla, Laravel or custom code — is in scope.

Not sure where to start?

Run the free check — it takes seconds.

Check my site