CVE-2026-109618 & CVE-2026-109619 — PHP2Shell

Are you affected by PHP2Shell?

CRITICAL · CVSS 9.2 · unauthenticated RCE

Two flaws in PHP core can let an unauthenticated attacker run code as your web worker. Enter your site's address and this tool reads the PHP version your server advertises — no need to look it up yourself.

Educational & authorized use only. This is a defensive self-check: it reads the version banner a server already publishes (like curl -I) and sends no attack traffic. Only check systems you own or are explicitly authorized to assess. Not for harm, and not for probing third-party sites without permission — doing so may be illegal.

Your website address — e.g. example.com. Only check sites you own or are authorized to assess.

Reads the version from your site's response headers — the same thing curl -I shows. It sends no attack traffic and does not test the vulnerability.

Fixed versions & how to read this

Branch	First fixed release
8.5.x	8.5.12
8.4.x	8.4.27
8.3.x	8.3.36
8.2.x	8.2.35
7.4 / 8.0 / 8.1 (end-of-life)	Source backports only — rely on your distro package

You are safe on a branch only at or above the release listed above. Anything below it is affected.