Is your site running a PHP version vulnerable to PHP2Shell?
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can let an attacker take over a web server without a password. They are already being exploited. Enter a site's address to see its PHP version and whether it's patched.
Not checked
Enter a site address and the result appears on this tag.
Affected and fixed versions
Every PHP version from 5.4 to 8.5.11 is affected. The fixes were released on 21 October 2026.
| Branch | Affected up to | Safe from | Branch status |
|---|---|---|---|
| PHP 8.5 | 8.5.11 | 8.5.12 | Active support |
| PHP 8.4 | 8.4.26 | 8.4.27 | Active support |
| PHP 8.3 | 8.3.35 | 8.3.36 | Security fixes only |
| PHP 8.2 | 8.2.34 | 8.2.35 | Security fixes only, until 31 December 2026 |
| PHP 5.4 to 8.1 | All | No fix | Unsupported. Move to 8.2.35 or newer. |
What to do if you're affected
In this order, as soon as you can.
Find the exact version
In your hosting panel (cPanel: Select PHP Version or MultiPHP Manager), in WordPress under Tools → Site Health → Info → Server, or on the server with
php -v. The command-line version can differ from the one serving the site.Update, or get written confirmation
Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared hosting your host does the update, so ask them to confirm in writing that the fix is applied. Updating WordPress, plugins or themes does not fix this.
Apply a temporary measure if you must wait
Setting
session.upload_progress.enabled = 0blocks one attack path for CVE-2026-109619. PHP says there is no complete mitigation, so this doesn't replace the update.Look for signs of compromise
Attacks started before the fix was public. Check for recently changed PHP files, especially in upload folders, new admin users, and unexpected outgoing connections from the server.
Time for a rewrite?
Sites stuck on old PHP are the ones PHP2Shell hits hardest. Their versions will never get a fix, and upgrading often breaks old themes and plugins. We rebuild your site on a current, supported stack, exactly as it is or with the changes you've been putting off.
Same site, new foundation
Your design, content and page addresses stay as they are, so visitors and search engines see the same site. Only what runs underneath changes.
Or improve it while we're at it
Tell us what you'd like to change, from a new layout to faster pages, and we'll include it in the quote.
A clear quote before any work
Send us the address and what you want. We reply by email with a quote, and nothing starts until you agree to it.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026. Both are rated 9.2 out of 10 (CVSS v4.0) and can let an attacker run code on the server without logging in. They're in the PHP interpreter, not in WordPress, plugins or themes.
Which PHP versions are affected?
All versions from PHP 5.4 up to 8.5.11. The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official fix, so the solution is moving to a supported branch.
How does the check work?
We load the site's home page and a few other public pages, read the X-Powered-By and Server headers, and look at the HTML to identify the CMS. We also look up the hosting network, Shodan's free scan history and the site's security.txt. We never send test payloads or try to trigger the vulnerability.
My site doesn't show its PHP version. Is it safe?
No. Hiding the header doesn't change the version running underneath. Check the version in your hosting panel or WordPress Site Health, or ask your host to confirm the fix is applied.
The version shown is old, but my host says it's patched. Who's right?
Possibly both. Debian, Ubuntu, Red Hat and other distributions often ship the security fix without changing the version number. When the version has a distribution suffix or the server reports a distribution, the result is marked as possibly patched, and the package changelog gives the final answer.
Sources
Everything on this page comes from these public sources. We update it when they publish something new.