PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. Both allow unauthenticated remote code execution. Every PHP release from 5.4 through 8.5.11 is affected.

Why can't the checker always tell if my site is vulnerable?

A well configured server hides its PHP version, so it cannot be read from outside. In that case, check on the server itself with php -v, or ask your host.

PHP2Shell Check checkphp.co.uk

Is your website exposed to PHP2Shell?

Q: How do I patch PHP2Shell?

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. There is no complete mitigation, so updating is the only safe fix.

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, let attackers run code on unpatched servers, and they are being exploited right now. Enter your web address for a free, instant check.

No exploit traffic sent
Nothing stored, nothing changed
Result in seconds

Can't read it from outside? Check it yourself

A well run server hides its PHP version, so the check above can't always tell. Pick where your site is hosted, follow the steps, then enter the version you find and we'll tell you whether you're covered.

Need help?

If your site came back vulnerable, or you would rather not touch PHP yourself, we can take care of it. Xigen looks after development and hosting for businesses across the UK, which includes keeping PHP patched and tested without breaking the site it runs on.

Send us the address and we'll take a look.

Email info@xigen.co.uk

What is PHP2Shell?

CVE-2026-109618 Remote code execution through PHP's out-of-memory handling, which can interrupt a request while its data is only partly set up.

CVE-2026-109619 Remote code execution through request state that survives after the memory behind it has been freed.

PHP2Shell is the name for these two flaws, disclosed on 21 October 2026. Both are rated 9.2 (CVSS v4.0) and let an unauthenticated attacker run code on the server. Every PHP release from 5.4 through 8.5.11 is affected.

Why can't you always tell?

A well configured server hides its PHP version, so this tool often cannot read it from outside. An undetermined result is not an all clear and not a fault. It means the only reliable check is on the server: run php -v, or use the platform guide above.

How do I patch PHP2Shell?

Update PHP. The flaws are fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you use your operating system's package manager, apply your vendor's updated packages.

There is no complete mitigation. Updating is the only safe fix. As interim hardening you can set session.upload_progress.enabled = Off, set fatal_error_backtraces = Off on PHP 8.5, and set pm.max_requests = 1 on your FPM pools. Those reduce the attack surface for CVE-2026-109619 only.