HomePHP2Shell checker
Is your websitesafe from PHP2Shell?
PHP2Shell is a pair of critical flaws in PHP that let attackers take over a web server without logging in. The fix came out on 21 October 2026 and attacks have already started. Type in your website address and we’ll check whether your site runs on PHP and, if your server shows it, whether its version has the fix.
Free, and safe to run. We load your home page once, like a browser would, and never send attack code.
About the vulnerability
What PHP2Shell is
PHP2Shell is the name given to two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Either one lets an attacker run their own code on a web server without logging in. From there they can change your site, add malware or take customer data. The PHP project rates both 9.2 out of 10.
PHP runs every WordPress, WooCommerce, Joomla, Drupal and Magento site, along with a lot of custom ones. The flaws are in PHP itself, so updating WordPress, your theme or your plugins won’t fix them. The PHP on your server has to be updated. On most hosting that’s done by your hosting company, or in your hosting control panel.
The PHP project says every PHP installation that serves web pages is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The researchers who found the flaws traced the affected code back to PHP 5.4. Sites on Shopify, Wix, Squarespace and similar platforms aren’t affected, because the platform runs the servers.
For a longer guide, read how to check your website for PHP vulnerabilities.
Fixed versions
| Your PHP | Fixed in | What to do |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update available |
| PHP 8.4 | 8.4.27 | Update available |
| PHP 8.3 | 8.3.36 | Update available |
| PHP 8.2 | 8.2.35 | Update available. Support ends on 31 December 2026. |
| PHP 8.1 and older | No release | Move to PHP 8.4 or 8.5, or get your host to confirm they've patched it. |
If you can’t update straight away
The PHP project lists settings that reduce the risk until you can update. They don’t make a server safe, so treat them as a stopgap. They need to go in php.ini or the PHP-FPM pool, not in .user.ini or ini_set(), and every PHP worker needs restarting afterwards.
memory_limit = -1
session.upload_progress.enabled = 0
; PHP 8.5 only
fatal_error_backtraces = 0If your site has been on an unpatched version since 17 October, it’s also worth checking for signs of a break-in: admin users you don’t recognise, new files in your site’s folders, or pages that redirect somewhere they shouldn’t.
Timeline
What happened, October 2026
17 October
Amazon's threat intelligence team records the first attempt to exploit the flaws, four days before they were made public.
20 October
The two CVE numbers leak on Hacker News. The PHP project brings its security release forward by a day.
21 October
PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare adds firewall rules for the known attacks, and Amazon reports the flaws are being widely exploited.
Check by version
Find your PHP version
If the checker couldn’t see your version, you can find it yourself in a couple of minutes. Then type it in below.
WordPress
Log in to your dashboard and go to Tools, then Site Health. Open the Info tab, expand Server, and look for PHP version.
cPanel hosting
Log in to cPanel and open MultiPHP Manager (on some hosts it's called Select PHP Version) in the Software section.
Plesk hosting
Open Websites & Domains, choose your domain and open PHP Settings. The version is at the top.
Anything else
Ask your hosting company which PHP version your site runs on, and whether they've applied the PHP2Shell fix.
Get it fixed
Ask us to fix it
Send us your website address and we’ll find out which PHP version it’s on, then sort the update, either in your hosting control panel or with your hosting company. If your site needs a newer version of PHP, we’ll test your theme and plugins on it first. We’ll reply within one working day.
Questions about PHP2Shell
If your question isn’t answered here, get in touch.
PHP2Shell is the name given to two vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Either one lets an attacker run their own code on a web server without logging in, which means they can change your site, add malware or take customer data. The PHP project rates both 9.2 out of 10 for severity and released the fix on 21 October 2026.
Tell us aboutyour project.
You can also email hello@webgro.co.uk or call 01344 231 119. We reply within one working day.