SECURITY GUIDE UPDATED 21 OCTOBER 2026
PHP2Shell exposure checker
Check your website for PHP2Shell exposure signals and see what to verify with your host. Fixed upstream releases start at PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
WEBSITE SCAN
Check your site's exposure
Scan for PHP2Shell exposure signals. No exploit payload.
Need help urgently?
Contact Lunover If your PHP site may be exposed, patch PHP now. Contact Lunover if you need help with the next step.
What is PHP2Shell?
PHP2Shell refers to two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. PHP's security advisory explains the two flaws: an out-of-memory error can leave request data partly initialized before cleanup, and request-owned state can remain after its memory is freed and be used by a later request. PHP says all installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.Which PHP versions are fixed?
PHP published these upstream fixed releases on 21 October 2026:| PHP branch | First fixed upstream release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
How to check PHP2Shell exposure on your website
- Find the PHP version used by your web server, not only your local computer. Check your hosting dashboard, PHP-FPM pool, container image, or server package inventory.
php -vchecks the command-line installation, which can differ from the web-serving runtime. - Compare its full
major.minor.patchversion with the fixed release table above. Check every web-serving PHP pool if your site uses more than one. - If your result is below the upstream fixed release, update PHP or verify a vendor backport through an official package advisory.
- Restart or recycle PHP workers after the update. Confirm the live runtime uses the patched package.
What should I do if my version is affected?
Patch PHP immediately. The PHP security team says updating is the only complete solution. If you use managed hosting, ask your provider which PHP package and security build serves your site, and when patched workers were restarted.If you cannot update immediately, PHP lists measures that reduce specific attack paths. These include limiting POST request size and settingsession.upload_progress.enabled=0 before request parsing, then restarting every worker. PHP warns that these measures do not make an installation safe. Follow the full PHP guidance for your deployment.PHP2Shell questions
Which websites may have PHP2Shell exposure?
PHP lists all installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The flaws are in PHP itself, so they are not limited to one CMS or framework. See PHP's advisory.When should I temporarily shut down my PHP website?
If a publicly reachable site runs an affected PHP build and you cannot patch it promptly, consider blocking untrusted web traffic or serving a static maintenance page until the fix is installed. That is a precaution based on PHP's warning that temporary measures do not make an affected installation safe. An application maintenance mode that still runs PHP does not remove exposure to PHP core flaws. If the site is already restricted to trusted users, keep that restriction in place and patch before reopening it publicly.Does every PHP site need to go offline?
No. First confirm the PHP build actually serving web requests. A site using a fixed upstream release or a documented vendor backport does not need to be taken offline solely for these two CVEs. If patch status is unknown, ask your host to verify it rather than treating a scanner result as proof.Can a CDN or WAF replace the PHP update?
No. Edge rules may block some attack requests, but they cannot establish that the PHP runtime is fixed. PHP says updating is the only complete solution. Keep any edge protections in place while you update, then confirm the patched build is running at the origin.Does disabling uploads or session upload progress fix PHP2Shell?
No. PHP listssession.upload_progress.enabled=0 and request-size limits as measures that reduce particular attack paths, not complete fixes. The session setting must apply before request parsing, and workers must be restarted. Disabling an upload button in the application is not a substitute for patching PHP. Follow PHP's full guidance if an update is delayed.