Is your site exposed to PHP2Shell?
Just drop in your website. We read your live PHP version and tell you in seconds if you're patched, vulnerable, or on an end-of-life branch — and exactly what to do next.
WordPress: Tools → Site Health → Info → Server. cPanel: Select PHP Version.
What is PHP2Shell (CVE-2026-109618 & CVE-2026-109619)?
PHP2Shell is the nickname for two critical flaws in PHP itself — both rated 9.2 (CVSS v4.0) — that let an attacker run code on your server without logging in. Because they live in PHP, every PHP site is exposed: WordPress, Drupal, Joomla and custom apps alike.
Unauthenticated RCE
An attacker needs no account and no password. A single crafted web request can reach the flaw while PHP parses the request body.
WordPress updates don't fix it
This is a PHP-engine bug. Updating WordPress core, themes or plugins changes nothing. Only a patched PHP version on the server closes it.
Exploited before the patch
Attack attempts were seen on Oct 21, 2026 — the day of release — before many hosts had updated. Some sites were hit before they were patched.
Patched PHP versions
Update to at least the release for your branch. Anything below it is vulnerable; branches older than 8.2 are end-of-life and get no official fix.
| PHP branch | Patched in | Status |
|---|---|---|
8.5 | 8.5.12 | Supported · fix available |
8.4 | 8.4.27 | Supported · fix available |
8.3 | 8.3.36 | Supported · fix available |
8.2 | 8.2.35 | Supported · fix available |
8.1 and older | — | End of life · upgrade required |
A host may backport the fix without changing the version number, so trust your host's status page over the version string alone. Turning off session.upload_progress.enabled blocks the known attack path for CVE-2026-109619 but is only a stopgap — updating PHP is the real fix.
Vulnerable, end-of-life, or not sure?
We patch PHP on self-managed servers and migrate end-of-life sites to a supported, patched version — tested on a staging copy first so nothing breaks when we flip it live.
Get your PHP patched & upgraded →PHP2Shell FAQ
Is my WordPress site vulnerable to PHP2Shell?
It depends on your server's PHP version, not on WordPress. If PHP is below 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 — or on 8.1 or older — the site is exposed until the server is updated. Use the checker above.
Does updating WordPress fix it?
No. PHP2Shell is a flaw in PHP itself. WordPress core and plugin updates don't touch it. Only a patched PHP version on the server fixes it.
My host says they patched it — am I safe going forward?
At the PHP level, yes, once their patched build is live. But exploitation started before many hosts updated, so your site may have been compromised in the gap. Patching doesn't remove a backdoor that's already there — you'd need to check for signs of compromise.
I'm on PHP 7.4 / 8.0 / 8.1. What now?
Those branches are end-of-life and get no official PHP2Shell fix. The real fix is upgrading to a supported version (8.2.35+). Some hosts offer paid backports (ELTS) as a short bridge — confirm with yours, but plan the upgrade.
Is this checker safe to use?
Yes. It reads only the public response headers your own site already sends — the same data curl -I yourdomain.com returns. It doesn't log in, scan pages, or test the exploit, and it only checks the site you enter.