Avisha GlobalAI · Security · Digital Trust
Talk to an Expert
Free Tool · PHP2Shell Exposure Check

Is your server exposed to PHP2Shell?

On 21 October 2026, PHP patched two critical flaws — CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell — that let an unauthenticated attacker run code on a web server. Exploitation is already being seen in the wild. Enter a domain for a free, read-only check of whether it is running a PHP version below the patched baseline.

Read-only checkNo exploit sentResult emailed to youCVE-2026-109618 / -109619
Run the Check About PHP2Shell
Version check No payload sent Result emailed to you

Check a domain

We make one ordinary web request to the domain and read the version its server reports in response headers — the same information any browser receives. We do not send an exploit, a payload or an upload. A server that hides its version returns an inconclusive result, not a clean bill of health.

We email the result here and may follow up once about remediation. No list, no drip sequence.

A header-based version check is a first signal, not a penetration test. It cannot see a backported fix, a reverse proxy rewriting headers, or a server that hides its version — and it does not test exploitability. Treat the result as a prompt to confirm the running build on the server itself.
Get Help Remediating This
About PHP2Shell

Two flaws, one unauthenticated path to code execution.

Both carry a CVSS 4.0 score of 9.2. They sit in PHP core, so any application on an affected version is in scope — not just a single framework or plugin.

CVE-2026-109618 — RCE via memory corruption

PHP's out-of-memory handling can abandon a request while its memory is only partly initialised, and request shutdown then treats that state as valid — a path to remote code execution. Interim mitigation: a per-worker cgroup memory limit.

CVE-2026-109619 — RCE via stale global state

PHP can retain request-owned state after the memory behind it is freed; a later request on the same worker consumes it. Interim mitigation: set session.upload_progress.enabled = Off.

Sources differ on which CVE covers the session.upload_progress vector. Confirm against PHP's official advisories (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp) before relying on either interim mitigation. The patched releases close both regardless.

How the check works

Read-only by design.

A responsible exposure check never attacks the thing it is checking. Here is exactly what happens when you press the button.

1

One normal request

We request the home page over HTTPS, exactly as a browser would. No crafted input, no upload, nothing that touches the vulnerability.

2

Read the version

We read the Server and X-Powered-By headers for a disclosed PHP version. Most well-configured servers hide it — and that is reported honestly as inconclusive.

3

Compare to the baseline

Any disclosed version is compared against the first patched release on its branch. Below it, or on an end-of-life branch, is flagged as likely exposed.

4

Email the result

You get the finding by email, with the fixed versions and next steps. If you want a hand, a specialist can scope remediation or a full VAPT.

FAQ

About the check

No. It makes a single ordinary web request and reads the version your server volunteers in its response headers — the same information a browser receives on any visit. It never sends an exploit, a payload, a crafted upload or anything that touches the vulnerability itself. This is a version check, not a penetration test.
It means your server does not reveal its PHP version in its headers, which is good practice — but it also means a header check alone cannot tell whether you are patched. You still need to confirm the running PHP build on the server. "Not disclosed" is reported as inconclusive, never as safe.
The check is read-only and equivalent to visiting the site, but you are asked to confirm you own the domain or are authorised to test it. Please only check infrastructure you are responsible for. Checks are rate-limited and logged.
PHP released the fix on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any later release on those branches also carries it. Branches older than 8.2 are end-of-life, are affected, and should be migrated off a supported branch. Updating is the only complete remediation.
The domain, the result and your email are sent to our team so we can email you the finding and, at most, follow up once about remediation. We do not add you to a mailing list or a drip sequence. Handling is covered by our privacy policy, and you can ask us to delete the record at any time.

Found something? Don't patch blind.

If the check flags exposure — or if your version is hidden and you want certainty — our team can confirm the running build, apply the fix without breaking the application, and check the rest of your estate for the same gap.

Talk to a Specialist Cybersecurity Services