PHP2Shell Checker

How to use

1. On the server, run php -v, or open a phpinfo() page on your website (delete it afterwards).
2. Paste the output above. The checker reads the PHP version, the Server API and session.upload_progress.enabled.
3. Read the verdict: Patched, Vulnerable, Check your package or No fix. Ubuntu and Debian builds are compared with their own fixed package versions.
4. If it is not patched, follow the steps below in order: look for signs of compromise, update, restart, then harden.

What is PHP2Shell?

PHP2Shell is the name for two critical bugs in PHP itself, published on 21 October 2026: CVE-2026-109618 (memory corruption when PHP runs out of memory while setting up a request) and CVE-2026-109619 (state left over from one request being reused by the next one on the same worker). Both are rated 9.2 and can let an attacker run code on a web server without logging in. Details leaked a day early and attacks were seen in the wild from 21 October.

Every PHP setup that serves web pages is in scope: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. Apache mod_php is the most exposed, because an attack can succeed before your site's code runs.

How to check your PHP version

On the server, php -v prints the command-line version. The version your website runs can differ, so also check the web one: create a file with <?php phpinfo(); in the site folder, open it in the browser, note the PHP Version and Server API, then delete the file. On cPanel or Plesk, the PHP version is listed under MultiPHP Manager or PHP Settings.

Fixed packages on Linux distributions

Distributions backport the fix, so the PHP number may not match the upstream release. Red Hat, AlmaLinux and Rocky builds keep their old numbers, so check the package changelog with rpm -q --changelog php-common | grep 109618.

Check if your server was already hacked

Do this before patching, since updating does not remove a backdoor. First copy the web server and PHP logs, the configuration and any suspicious files somewhere safe.

Look for PHP files that appeared or changed in your web folders since 20 October, for example with find /var/www -name '*.php' -newermt 2026-10-20, especially in upload and cache folders. Check the logs for PHP workers that crashed or hit the memory limit, and for unusually large or deeply nested multipart POST requests. Review crontab entries, new user accounts and SSH keys, and outbound network connections from PHP processes (ss -tp | grep php). If you find anything, isolate the server and get incident-response help before cleaning up, and change the passwords, API keys and tokens the site uses.

How to fix PHP2Shell

Update PHP: on Ubuntu or Debian run sudo apt update && sudo apt upgrade; on AlmaLinux, Rocky or RHEL run sudo dnf upgrade 'php*'; with the official Docker images, pull the fixed tag and redeploy. Then restart every PHP worker (for example sudo systemctl restart php8.3-fpm, or restart Apache for mod_php). Old workers keep running the vulnerable code until restarted.

If you cannot update straight away, take the server off the internet or put it behind a firewall. PHP's temporary mitigations reduce but do not remove the risk: set session.upload_progress.enabled = 0 in php.ini or the FPM pool, keep post_max_size small (8M, or 32M with uploads), limit request size and multipart parts at the web server, and on PHP 8.5 set fatal_error_backtraces = 0. Restart workers after each change; ini_set() and .user.ini do not work for this.

Frequently asked questions