Is your site affected by PHP2Shell?

The advisory at a glance

• CVE: CVE-2026-109618 · CVE-2026-109619
• CVSS 4.0: 9.2 · critical
• Impact: remote code execution, no authentication
• Fixed releases: published October 21, 2026
• Exploitation: already reported in the wild

Update to at least: 8.2.35, 8.3.36, 8.4.27, 8.5.12

What PHP2Shell is

Two vulnerabilities in PHP itself, published together: CVE-2026-109618 and CVE-2026-109619. They are rated 9.2 on CVSS 4.0, which is critical, and allow remote code execution without authentication. PHP published the fixed releases on October 21, 2026, and exploitation in the wild has already been reported: the update should not wait for the next maintenance window.

Who is affected

Any PHP that serves web requests, whatever connects it to the web server. Shared hosting accounts too: the provider runs PHP in one of these ways, and either you pick the version or the provider updates it.

• mod_php: the Apache module
• PHP-FPM: behind nginx, Apache or Caddy
• CGI: php-cgi, FastCGI included
• LiteSpeed: LSAPI, common on shared hosting
• FrankenPHP: PHP embedded in the server

Which PHP versions carry the fix

On each branch, any release older than the one in the table is affected. PHP 8.1 and older get no official release with the fix: only distribution and vendor packages can carry it.

Ubuntu, advisory USN-8948-1

Ubuntu keeps PHP’s version number and ships the fix in the package revision. The first fixed revisions:

Debian, Red Hat, CloudLinux and hosting providers may also ship the fix under an older number. Their own advisory decides; our check reports these builds as “distribution build, to confirm”, and the agent reads the installed package.

How to update

1. Update PHP: On a server of your own, install the updated PHP packages from your distribution or from the repository you installed PHP from. On a hosting account, pick an updated version in the account’s PHP settings or ask your provider. On 8.1 and older, move to a maintained branch or to a vendor package that carries the fix.
2. Restart PHP: Restart PHP-FPM, or the web server when PHP runs inside it (Apache with mod_php, LiteSpeed). Until then, the PHP processes that were already running keep the old version.
3. Check again: Run the check again from your dashboard. If the server hides its version, the agent confirms the installed version and package.

If you cannot update today

The PHP and vendor advisories give these settings for the time until you update. They reduce exposure without removing it, and they do not replace updating.

• session.upload_progress.enabled = 0: in php.ini, for every PHP version you run
• memory_limit = -1: set by the administrator, in php.ini or the PHP-FPM pool
• post_max_size: lowered to the smallest value your sites work with
• fatal_error_backtraces = 0: on PHP 8.5

Then restart every PHP worker: PHP-FPM, or the web server when PHP runs inside it. Workers that are already running do not see the new settings.

What the check does, and what it does not

The check sees your site the way a visitor does. That is what makes it safe on a production site, and also why it cannot always answer.

What it does

• Ordinary GET requests, like a browser’s: the home page, following its redirects within the same domain.
• Only if the version has not shown up yet, two or three more addresses where PHP usually answers, such as /index.php.
• It reads the PHP version from headers such as X-Powered-By and Server, plus the signs that a site runs PHP.
• Every request names us in its user agent, so you can find it in your access log.

What it does not do

• No attack traffic: no payloads, no form submissions, no login attempts.
• It does not follow redirects to another domain: it tells you where the site sends visitors and stops.
• It refuses addresses on private networks.
• A hidden version is never reported as patched.

The definite answer: the agent

The Valinor agent runs on the server itself and reads the installed PHP version and package, including fixes your distribution ships under an old number. It is read-only by default.

from Starter, 4.9 EUR/month

It is not a vulnerability scan. For what can actually be exploited: Vulnerability Assessment

What each result means

Affected

The version your server shows is older than the fixed release of its branch. Update, then restart PHP.

No official fix for this branch

PHP 8.1 or older: PHP publishes no release with the fix. Move to a maintained branch, or confirm that your distribution’s package carries it.

Distribution build, to confirm

The number is older than the fix, but it comes from a distribution package (Debian, Red Hat, CloudLinux and others) that may carry the fix under the old number. The vendor’s advisory decides, or the agent does.

Version hidden

The site runs PHP but does not say which version. It is a common result and means neither affected nor patched: the agent can tell.

Version outside the advisory

A newer branch or a test build (RC, dev) that the advisory does not cover. We do not guess.

Unreachable

The site did not answer over HTTPS or HTTP in time. Check that the domain points to the server, then try again.

Sends visitors elsewhere

The site redirects to a different domain, which we do not follow. Check that domain instead.

No PHP seen

Nothing in the responses points to PHP. PHP may still run on the same server, under another name or address.

Patched

The version shown is the fixed release of its branch or newer, or an Ubuntu revision from USN-8948-1 or newer.

Free for one site, unlimited on paid plans

Free

One site. The first domain you check becomes your account’s site, and rechecking it is included.

Paid plans

Starter, Plus, Pro, Ultra

As many sites as you need. From Starter you can also install the agent, which reads the PHP version straight from the server.

See pricing

Questions about PHP2Shell and the check

Is the check safe to run on a live site?

Yes. It sends a few GET requests, the same a browser would, and reads the answers. No attack traffic, no payloads, no forms, no login attempts. Each request names us in its user agent.

Why can’t you see my PHP version?

Many servers do not show their version (expose_php = Off, or a proxy in front). That is good hygiene, but it also means nobody can judge the version from outside, us included. A hidden version is not a patched version: the agent reads the installed one.

My distribution shows an older version. Am I affected?

Not necessarily. Ubuntu fixed PHP2Shell in USN-8948-1 under the old version numbers, and the check knows those revisions. Debian, Red Hat, CloudLinux and hosting providers may do the same: their advisory decides, or the agent, which reads the installed package.

I updated PHP, but the result still says “affected”.

Restart PHP-FPM, or the web server when PHP runs inside it: workers started before the update run the old version until they restart. Then check again.

Which sites can I check?

Any public domain: the check sees nothing more than any visitor does. On the Free plan the first domain you check becomes your account’s site, and rechecking it is included; paid plans have no limit. Addresses on private networks are refused.

Do the interim settings make me safe?

Not fully. They reduce exposure while you schedule the update, and they only apply once every PHP worker has restarted. Updating is the fix.

Find out where your site stands

Type the domain. The check reads what your server shows any visitor, and the agent confirms what is installed.

Start free