EA Digital Solutions
SEOSchemaMeta TagsBriefGEOOG PreviewImageColorsBGUTMRedirectsPHPMockup

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

PHP Check: is your website affected?

On 21 Oct 2026 PHP closed a critical vulnerability (PHP2Shell). This free check shows which PHP version your website reports — and what the next step is.

Please only check websites you own or are responsible for. The check loads your start page once — like a browser — and reads response headers and HTML. No attacks or test payloads are sent.

Knowledge

PHP2Shell: what happened

On 21 Oct 2026 the PHP project fixed two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution. The PHP security team rates them CVSS v4.0 9.2. Every PHP setup that serves web requests is affected — PHP-FPM, mod_php and FrankenPHP — with the highest risk for mod_php.

Fixed versions

PHP 8.5

from 8.5.12

PHP 8.4

from 8.4.27

PHP 8.3

from 8.3.36

PHP 8.2

from 8.2.35

PHP 8.1 and older: no fix

These versions are end-of-life. The only way out is an upgrade to a maintained PHP version — or, if theme and plugins do not allow that, a rebuild.

What to do now

  1. 1.Find out the PHP version (hosting panel or your host).
  2. 2.Update to a fixed version — usually your host does this.
  3. 3.Until then: set session.upload_progress.enabled = 0.
  4. 4.Check for suspicious files and unknown admin accounts.
  5. 5.On WordPress: update plugins and renew UpdraftCentral keys if you use it — attackers reportedly used such keys to plant backdoors.

Need help with the update? Contact us →

Frequently Asked Questions

What does the PHP check actually do?

It loads the start page of the address you enter once, like a browser, and reads the response headers and the first part of the HTML. It looks for the PHP version (X-Powered-By, Server), a PHP session cookie and CMS hints such as WordPress. No other pages are requested and no attack or test payload is sent.

The check shows no version. Is my site safe?

Not necessarily. Many servers hide the PHP version on purpose. That is good practice, but it says nothing about whether the update is installed. Look up the version in your hosting panel or ask your host.

Which PHP versions contain the fix?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 21 Oct 2026) and newer. PHP 8.1 and older are end-of-life and receive no fix.

Is there an interim measure until the update?

The leaked material pointed at the session upload progress feature, which is on by default. Setting session.upload_progress.enabled = 0 is the recommended interim measure. It does not replace the update.

Sources