XDEFENSE PHP2Shell Exposure Check
CVE-2026-109618 · CVE-2026-109619 · Version check

Is your PHP patched
against PHP2Shell?

PHP2Shell is a pair of critical, actively-exploited remote-code-execution flaws in PHP's request parser. This check reads the PHP version your site reports and compares it to the fixed releases, then emails a signed PDF with one clear next step. It reads the version only — never the exploit.

⚠ 9.2 (CVSS v4.0, Critical) 🔒 Your own domain only ✉ Work-email verification 🛡 reCAPTCHA protected
Run the check
https://
Enter a public URL you are responsible for. One normal request is sent to read its version header.
Must be on the same domain as the URL. Free providers are rejected.
PHP
Only if the version header is hidden. Format 8.3.12.
Result is emailed to your work address as a PDF.
What has been discovered

What is PHP2Shell

Two critical flaws in PHP's handling of HTTP requests let an unauthenticated attacker reach remote code execution just by sending requests to a PHP endpoint. They were discovered by Wiz Research in August 2026 using frontier AI models, reported privately, and patched on 21 October 2026 after details leaked ahead of the planned disclosure. Exploitation has since been observed in the wild.

CVE-2026-109618Memory corruption

Memory corruption reached through out-of-memory conditions while PHP parses multipart (file upload) requests. Remote code execution was demonstrated on mod_php.

CVE-2026-109619Use-after-free

A use-after-free triggered on the request following a fatal error. Remote code execution was demonstrated on both mod_php and PHP-FPM.

The findings

Affected & fixed releases

Nearly every PHP release of the last decade is affected, back to PHP 5.4. Supported branches are fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (8.2 reaches end-of-life on 31 Dec 2026). PHP 8.1, 8.0, 7.x and 5.x are unsupported and need vendor or source backports.

LineFixed releaseStatus
PHP 8.28.2.35Supported
PHP 8.38.3.36Supported
PHP 8.48.4.27Supported
PHP 8.58.5.12Supported
PHP 8.1 & olderno official releaseEnd-of-life
How it works

Four gated steps

1 · Verify

Work-email domain must match the site's domain; confirm permission; pass reCAPTCHA.

2 · Read version

One ordinary request reads the version from the response headers. Never the exploit.

3 · Assess

The version is compared to the fixed releases per line, giving one clear verdict.

4 · Deliver

A branded, dated PDF is emailed to the verified work address.

Disclosure timeline

How it unfolded

  1. Aug 2026Wiz Research — with the PHP team, Calif and OpenAI — discovered the flaws using frontier AI models (Gemini 4 Argon, GPT-5.6 Sol). First bug found 19 Aug; unauthenticated RCE confirmed against Drupal and WordPress; reported to PHP on 24 Aug.
  2. 21 Sep 2026The PHP security team acknowledged the reports and began a coordinated fix.
  3. 20 Oct 2026Details and the reserved CVE IDs leaked ahead of coordinated disclosure. "PHP2Shell" proof-of-concept tools surfaced and watchTowr independently reproduced the exploit. PHP pre-announced an emergency release for 21 Oct, 14:00 UTC; CERT-EU issued advisory 2026-018 (CVSS v4.0 9.2).
  4. 21 Oct 2026PHP accelerated its schedule and published emergency patches — 8.5.12, 8.4.27, 8.3.36, 8.2.35. In-the-wild exploitation was reported (Cloudflare 07:43 UTC, Aikido 09:18 UTC); AWS and Cloudflare published customer mitigation and WAF guidance.
  5. 22 Oct 2026Threat-intelligence providers noted that while scanning and attacks were ongoing, reliable exploitation often depends on specific server configurations rather than working universally on default deployments.
Need deeper coverage?

For a full assessment beyond this version check — configuration, exposed endpoints and remediation support — talk to the XDEFENSE team.

✉ letstalk@xdefense.io
Primary sources
GHSA-w8hw-w9fx-j79w GHSA-6wmf-4rv5-p3rp php/php-src php.net supported versions