Is your site hit by PHP2Shell?
Two critical unauthenticated RCE flaws (CVE-2026-109618 & CVE-2026-109619) affect all PHP up to 8.5.11. Scan a website's public signals or check a PHP version against the official patched releases.
Passive check only — reads public headers and markup. No exploit traffic is sent, and hidden versions can't be detected remotely.
Two related critical remote-code-execution vulnerabilities in PHP's core, disclosed and patched on 21 October 2026.
RCE via out-of-memory corruption. When a request hits PHP's memory_limit at the wrong moment, cleanup code can free memory that was never initialised — attacker-controlled data included. On Apache mod_php it's triggerable before application code runs, fully unauthenticated.
RCE via stale global state. Internal request state can survive after its memory is freed (e.g. after a fatal error); a later request on the same worker can reuse that freed memory — a use-after-free leading to remote code execution.
Every PHP installation serving web requests from 5.4 through 8.5.11 is affected — PHP-FPM, Apache with mod_php (highest demonstrated risk), php-cgi, FrankenPHP and LiteSpeed. WordPress, Drupal, Laravel, Magento and every other PHP app inherit the risk from the runtime. Updating plugins or app code does not fix this — only the PHP runtime update does.
| PHP branch | Vulnerable range | First patched version |
|---|---|---|
| 8.5.x | 8.5.0 – 8.5.11 | 8.5.12 |
| 8.4.x | 8.4.0 – 8.4.26 | 8.4.27 |
| 8.3.x | 8.3.0 – 8.3.35 | 8.3.36 |
| 8.2.x | 8.2.0 – 8.2.34 | 8.2.35 |
| ≤ 8.1 (incl. 7.x, 5.x) | All versions | No upstream fix — migrate or vendor backport |
Some distributions and LTS vendors ship backported fixes without bumping the version number — verify with your host before assuming an old-looking version is unpatched.
List every server, container and hosted app running PHP — including sites where PHP hides inside other software.
Update to a fixed release and restart PHP-FPM/Apache so it takes effect. Prioritise internet-facing systems.
CISA's guidance: take the system offline, or put a WAF rule in front as a temporary bridge — never as a substitute.
Watch for PHP workers spawning shells, unexpected outbound downloads, new admin accounts or modified files.
Built into AskZyro
CMS detectors, hash generators, code tools and 50+ more — all free in one workspace.