PHP2Shell Scanner
● CVE-2026-109618 & CVE-2026-109619 · CVSS 9.2 · disclosed Oct 2026

Is your website vulnerable to PHP2Shell?

A critical PHP flaw lets attackers run code on your server with no login. Enter your site for a free, instant, read-only security report.

🔒 Passive & read-only — one normal request, we never attack your site · We don’t store your results · Free

What is PHP2Shell?

On 21 October 2026, the PHP team shipped emergency patches for two critical remote-code-execution flaws in PHP core, nicknamed PHP2Shell. Virtually every PHP version from the last decade is affected by at least one of them. Read the full explainer →

CVE-2026-109618

RCE via OOM corruption

A failed allocation during request start-up leaves memory in an invalid state that request shutdown then reads, enabling unauthenticated remote code execution.

CVE-2026-109619

RCE via stale global state

Request-owned global state survives in a reused worker after its memory is freed — a use-after-free that can be turned into remote code execution.

Patched versions

Update to one of these (or newer) — the only complete fix:

8.2.358.3.368.4.278.5.12

How the check works

We request your homepage exactly like a browser and analyse that single response. No exploit, no payload, nothing intrusive — and we never probe hidden files.

1
You submit your URL. One normal GET request.
2
We analyse the response. PHP version, server, CMS, HTTPS/HSTS, security headers and cookie flags.
3
You get a full report + an A–F grade, with an honest note when your server hides its version.
⚠️ Honest limitation: a well-configured server hides its PHP version, so we return Unknown rather than guess. “Unknown” does not mean “safe”. Confirm from inside the server — see 4 ways to check.

How to fix it

Updating PHP is the only complete mitigation.

1 · Update PHP now

Move to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or newer. cPanel, Ubuntu & Docker steps →

2 · On an old branch?

PHP 8.1 and below are end-of-life with no patch — upgrade to a supported branch. Full guide →

3 · Can’t patch yet?

Apply temporary mitigations as a stopgap. See mitigations →

From the blog

Independent, in-depth guides on PHP2Shell.

Explainer

What Is PHP2Shell? CVE-2026-109618 & CVE-2026-109619 Explained

A plain-English guide to PHP2Shell, the two critical PHP remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) disclosed in October 2026 — how they work, who is affected, and what to do.

7 min read
Guide

How to Fix PHP2Shell: Complete Patching Guide (CVE-2026-109618 & 109619)

Step-by-step guide to fixing PHP2Shell on your website: check your PHP version, update to a patched release, restart your stack, and verify the fix.

6 min read
How-to

Is My Website Affected by PHP2Shell? 4 Ways to Check Your PHP Version

Four reliable ways to find your website's PHP version and know whether it is vulnerable to PHP2Shell — from a quick external scan to php -v over SSH.

5 min read

View all guides →

Frequently asked questions

Is this scan safe and legal to run on my site?

Yes. It loads your site like an ordinary visitor and analyses that one response. It sends no exploit and does not probe hidden files. Only scan sites you own or are authorized to test.

My result says “Unknown” — am I protected?

Not necessarily. Unknown means your server hides its PHP version. Confirm via your hosting panel, WordPress Site Health, or php -v.

Do you store my URL or the result?

No. The check runs in memory and the result is shown only to you. We keep no database of scanned or vulnerable sites.

Which versions are safe?

PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer.