What is php2shell (CVE-2026-109618 / CVE-2026-109619)?

php2shell is the name for two remote code execution vulnerabilities in PHP itself (not in an application or framework), each rated CVSS v4.0 9.2. They were announced on 20 October 2026, with PHP's fix scheduled for 21 October 2026 at 14:00 UTC. Sansec reports they affect all web servers running PHP 5.4 or later.

Which PHP versions are affected?

At the time of writing the PHP advisory had not yet published affected ranges or fixed versions. A leaked screenshot of the exploit tool claims it works against every release from 5.4.0 on. Once PHP publishes fixed releases, this checker compares your detected version against them.

Will my PHP version get a fix?

PHP upstream only supports 8.2 and later. PHP 8.1 and older will get no official fix, so a site on those branches stays exposed until it is upgraded to a supported branch.

What can I do before I can patch?

Sansec lists two temporary mitigations in php.ini: session.upload_progress.enabled = 0 and session.use_strict_mode = 1. Syhunt's php2shell-protection kit adds a web-server/WAF rule that rejects multipart/form-data POST requests before they reach PHP. Treat these as stopgaps, not a replacement for the official fix.

What does the checker look at — and what does it not do?

Only requests an ordinary browser or search-engine crawler already makes. The check fetches your home page and reads the X-Powered-By header, the Server header and any PHP session cookie; requests one deliberately nonexistent .php page, because some servers reveal the PHP version on error pages; and requests the PHP logo easter-egg URL, which only PHP older than 5.5 answers. It does NOT attempt exploitation, does NOT send anything shaped like the suspected attack (no multipart POST, no upload-progress field, no file part), and does NOT scan for files or paths — no phpinfo.php, .env, backups or wordlists. So it cannot confirm that a site is vulnerable, only which PHP version it runs.

Why is my result inconclusive?

Many servers hide the PHP version (expose_php = Off and no version in the Server header) or do not reveal that PHP is running at all. An inconclusive result is not a sign the site is safe — check the version on the server itself, for example with php -v.

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ curl -sI https://target.example/ | grep -i powered

X-Powered-By: PHP/8.2.27

sh-5.2$ id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

sh-5.2$ uname -a

Linux web-01 6.1.0-18-amd64 #1 SMP x86_64 GNU/Linux

sh-5.2$ ls /var/www/html

config.php index.php uploads

sh-5.2$ cat /etc/hostname

web-01

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ nc -lvnp 4444

listening on [any] 4444 ...

connect to [10.0.0.5] from (UNKNOWN) [203.0.113.24] 51834

$ hostname

api-02

$ php -v

PHP 8.3.14 (cli) (NTS)

$ env | grep DB_

DB_HOST=10.0.3.12

DB_USER=app

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

$ curl -s -D - -o /dev/null https://shop.example/x

HTTP/1.1 404 Not Found

Server: Apache/2.4.62 (Debian)

X-Powered-By: PHP/8.1.31

$ curl -sI https://shop.example/ | grep -i cookie

Set-Cookie: PHPSESSID=9f2c41ab07; path=/

bash-5.1$ pwd

/var/www/shop/public

bash-5.1$ ps aux | grep php-fpm

www-data 812 php-fpm: pool www

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

www-data@cms-03:/var/www$ whoami

www-data

www-data@cms-03:/var/www$ ls -la /tmp

drwxrwxrwt 9 root root 4096 .

-rw-r--r-- 1 www-data www-data 212 sess_a81f

www-data@cms-03:/var/www$ cat /proc/version

Linux version 5.15.0-122-generic (Ubuntu)

www-data@cms-03:/var/www$ php -r 'echo PHP_VERSION;'

8.2.24

www-data@cms-03:/var/www$ exit

Free php2shell Checker

Is the PHP behind your site exposed to php2shell?

Enter a domain. We read the PHP version and match it against the php2shell core RCEs (CVE-2026-109618 / CVE-2026-109619) — in seconds. No signup. No agent.

Read our php2shell analysis

PHP Version Fingerprinting

Reads X-Powered-By, the Server header, a 404 page's headers, the PHP session cookie and the PHP easter-egg URL — strongest signal first.

Fixed-Release Matching

Compares the version against PHP's fixed releases and flags branches (8.1 and older) that get no fix.

No Exploitation

Nothing beyond what a browser sends. The tool never attempts the RCE, so it never claims a confirmed hit.

F.A.Q.

Find answers to common questions about php2shell and this checker