Free online vulnerability checker, minimum secure PHP version matrix (8.5.12, 8.4.27, 8.3.36, 8.2.35), and platform patch guides.
Passive check: sends a single non-destructive GET request to inspect HTTP response headers. No exploit, no POST body, no fuzzing.
Source: Upstream php.net security releases and GitHub advisories (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp), published 21 October 2026.
| PHP Branch | Vulnerable Scope | First Fixed Release | Official Status & Action Required |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 | Active Support — Upgrade to 8.5.12+ |
| PHP 8.4 | < 8.4.27 | 8.4.27 | Active Support — Upgrade to 8.4.27+ |
| PHP 8.3 | < 8.3.36 | 8.3.36 | Active Support — Upgrade to 8.3.36+ |
| PHP 8.2 | < 8.2.35 | 8.2.35 | Security Only (EOL Dec 2026) — Upgrade to 8.2.35+ |
| PHP 8.6 | < 8.6.0RC4 | 8.6.0RC4 | Development RC — Testing only, not for production |
| PHP 8.1, 8.0, 7.4 | All versions | No official release | End of Life (EOL) — Vulnerable unless vendor backported patch |
| PHP 5.4 – 7.3 | All versions | No fix available | Legacy Vulnerable — Disable session.upload_progress |
Ubuntu, Debian and RHEL backport security fixes without updating upstream version numbers (e.g. Ubuntu 22.04 ships 8.1.2-1ubuntu2.28). Check your package changelog using our Ubuntu fix guide before panicking.
Follow these steps in strict sequence. Nothing else provides complete protection against PHP2Shell.
Audit web servers, Docker containers, base images, and staging sites. Note that your CLI version (php -v) may differ from what PHP-FPM or Apache actually executes.
View inventory commands →Upgrade to official releases: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Updating CMS plugins (WordPress, Drupal, Laravel) does NOT fix PHP core runtime vulnerabilities.
Select your platform guide →CRITICAL STEP: Upgraded binaries are NOT loaded until worker pools are restarted. Restart PHP-FPM, Apache, FrankenPHP, Swoole, and queue workers immediately.
Confirm the active web server reports the patched version. Audit access logs since early October 2026 for abnormal multipart upload crashes, and rotate critical database and API keys.
Re-run diagnostic check →Step-by-step update commands, changelog verification, and service restart procedures tailored to your infrastructure.
Check package versions with dpkg, verify CVE changelog backports, update with apt-get, and restart php-fpm pools safely.
Read Ubuntu / Debian GuideContainers never update themselves. Pull official patched base images (e.g. php:8.3.36-fpm), rebuild compose stacks, and deploy clean containers.
Read Docker GuideAudit EasyApache 4 multi-version setups and CloudLinux alt-php packages. Verify RPM changelog backports and upgrade via dnf/yum.
Read cPanel GuideHow to protect WordPress sites on shared hosting when you lack root access. Hosting ticket templates and temporary WAF mitigation.
Read WordPress Hardening GuideDeploy emergency edge filters before backend patches can be scheduled. WAF expression rule syntax and body inspection limits.
Read Cloudflare WAF GuideCopy-paste terminal inspection commands for RHEL, Plesk, aaPanel, and FrankenPHP to verify active runtime builds.
Jump to CommandsRun these commands via SSH on your servers to determine the real active PHP package version:
dpkg -l 'php*' 'libapache2-mod-php*' | grep ^ii
zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php*-common/changelog*rpm -qa | grep -Ei "^(php|ea-php|alt-php)" | sort
rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"docker exec -it <container_name> php -v
docker exec -it <container_name> php -m | grep sessionNot necessarily. Hiding X-Powered-By only conceals the version banner; it does not fix the underlying vulnerability. Run the self-check CLI commands directly on your server.
No. It sends one normal GET request to inspect HTTP response headers. It transmits no exploit payloads, no POST bodies, and performs no path scanning.
Yes. Disabling session.upload_progress.enabled = Off in your global php.ini and reloading PHP-FPM neutralizes the primary UAF attack path. However, php.net advises that updating the PHP engine is the only comprehensive resolution.
Package updates only update files on disk. Running PHP-FPM and Apache worker processes retain the vulnerable code in RAM until services are restarted.
No. While WAF rules can block known exploit signatures, adversaries can pad multipart boundaries or alter chunk sizes to bypass inspection bodies without triggering WAF thresholds.
No. All PHP versions from 5.4 through 8.5 are structurally vulnerable to the RFC1867 upload progress UAF. Because 7.4 and 8.0 are EOL, you must apply vendor backports or disable upload progress.
Pure CLI execution without multipart POST handling is generally not exposed. However, web-accessible SAPIs (PHP-FPM, Apache mod_php, FrankenPHP, Swoole) are fully vulnerable.
No. Security plugins execute inside PHP userland AFTER the engine parses multipart requests. The vulnerability triggers in native C code before any PHP plugin executes.
Technical analysis of how PHP2Shell defeats ASLR without interactive memory leaks: PIE deficiencies, fork() address inheritance, Linux distro security matrices, and crash-throttling mitigations.
Real-world telemetry from high-interaction honeypots in Frankfurt and Silicon Valley: weaponization timeline for PHP2Shell (CVE-2026-109618 & CVE-2026-109619), payload shortcuts, and post-exploitation forensics.
Deep C-source analysis of php2shell CVE-2026-109619 and CVE-2026-109618 in ext/session/session.c and main/rfc1867.c, showing how static global pointer caching triggers a Use-After-Free heap write.
Comprehensive technical advisory for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Unauthenticated RCE affecting PHP core runtimes across PHP-FPM, Apache mod_php, and FrankenPHP. CVSS 9.2, affected versions PHP 5.4–8.5.
Step-by-step emergency mitigation playbook for php2shell CVE-2026-109618 and CVE-2026-109619: zero-downtime php.ini hardening, perimeter Nginx filtering, and custom compilation of EOL PHP 8.1 backports.
Deep architectural dissection of the php2shell CVE-2026-109618 and CVE-2026-109619 exploitation chain: ZMM heap bin recycling, 16-byte fake zval layout, ASLR bypass via FPM forks, and vtable hijacking to system().
Technical post-mortem on sub-500-byte PHP2Shell payloads (CVE-2026-109618 & CVE-2026-109619): how compact multipart boundaries bypass perimeter WAF inspection, payload anatomy, and detection mechanics.
Defensive threat hunting playbook for PHP2Shell (CVE-2026-109618 & CVE-2026-109619): ready-to-deploy Suricata signatures (SID 10261092), Falco runtime rules, and Linux auditd telemetry.
End-to-end defensive engineering playbook for PHP2Shell (CVE-2026-109618 & CVE-2026-109619): perimeter Nginx ingress rules, ModSecurity/Coraza virtual patches, and systemd process sandboxing.
Kernel-level zero-trust defense for PHP-FPM: how Seccomp-BPF filters execve, fork, and clone to neutralize PHP2Shell (CVE-2026-109618 & CVE-2026-109619) at the Linux kernel boundary.