# php2shell.fyi

> Independent public checker and plain-language guides for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in PHP itself. The only complete fix is a PHP update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or a later release in the same branch), followed by a restart of every PHP process. Not affiliated with the PHP project or php2shell.com.

## Key facts

- PHP2Shell is two flaws in the PHP runtime, not in WordPress, Drupal or other apps. App updates do not fix it.
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp). The PHP project rates both CVSS v4.0 9.2 (Critical).
- Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later releases in the same branch. Source: php.net advisory of 2026-10-21, https://www.php.net/archive/2026.php#2026-10-21-5
- PHP 8.2 security support ends on 2026-12-31.
- PHP 8.1, 8.0 and 7.4 get no new release. The PHP project published source backports only, so these need a patched vendor build or an upgrade.
- PHP 8.6.0RC4 contains the fix. Earlier 8.6.0 test builds do not. Release candidates are not for production.
- Linux distributions (Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux, Alpine) ship fixed packages; some (Ubuntu, the RHEL 9 default PHP) keep the old PHP version number. Compare the full package version, not only `php -v`.
- After the update, restart PHP-FPM, Apache (mod_php) and every long-running PHP worker, and rebuild container images.
- Interim measures reduce specific attack paths only. They are not a fix.

## How the checker works

- A person enters a website URL at https://php2shell.fyi/ and confirms they own the site or have permission to check it.
- Every check needs a Cloudflare Turnstile human check. Scripts and agents cannot call the API without it. Send users to https://php2shell.fyi/ to run a check themselves.
- The checker sends at most three ordinary GET requests (the URL and same-site redirects) and reads the status, a short list of response headers, cookie names and page markers.
- An optional active scan, started only by the user after a separate confirmation, sends test requests from our scanner server (User-Agent PHP2Shell-Private-Scanner/1.0). Its result is an unverified indicator: needs-review, fixed-version-reported, no-signal or inconclusive.
- It reports the PHP version the site shows in public, the evidence, and next steps. A public check cannot see vendor backports or hidden versions, so a result is never proof that a site is or is not exposed.
- Submitted URLs and results are not stored.

## Pages

- [Checker](https://php2shell.fyi/): check a website for public signs of PHP2Shell exposure
- [What is PHP2Shell](https://php2shell.fyi/what-is-php2shell): the two flaws in plain words, who is affected, what to do now
- [Fixed versions](https://php2shell.fyi/fixed-versions): fixed release and support end date for each PHP branch
- [Check your PHP version](https://php2shell.fyi/check-php-version): phpinfo, php -v, php-fpm -v, packages, Docker and hosting panels
- [Fixed PHP packages on Linux](https://php2shell.fyi/linux): exact fixed package versions for Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux and Alpine
- [Ubuntu](https://php2shell.fyi/linux/ubuntu): fixed php8.x packages, Ubuntu Pro builds, dpkg and apt policy commands, PHP-FPM restart
- [Debian](https://php2shell.fyi/linux/debian): fixed php8.4 and php8.2 packages for trixie and bookworm, testing and unstable status
- [RHEL, AlmaLinux and Rocky Linux](https://php2shell.fyi/linux/rhel): fixed builds per module stream, rpm -q commands, the RHEL 7 status
- [Alpine Linux](https://php2shell.fyi/linux/alpine): fixed php82 to php85 packages per release, apk commands, containers
- [PHP 7.4, 8.0 and 8.1](https://php2shell.fyi/end-of-life-php): no fixed release; the source backports, vendor builds with the fix, interim measures
- [Mitigations](https://php2shell.fyi/mitigations): interim php.ini and server measures until you update, and what to do after
- [Technical write-up](https://php2shell.fyi/technical): how the bugs work, per-SAPI status, what the fix changes
- [FAQ](https://php2shell.fyi/faq): short answers about PHP2Shell and the checker
- [Platforms](https://php2shell.fyi/platforms/): overview for CMS, frameworks and hosting panels
- [WordPress and WooCommerce](https://php2shell.fyi/platforms/wordpress): find the PHP version and why Site Health can show green
- [Drupal](https://php2shell.fyi/platforms/drupal): Status report and supported fixed PHP per Drupal version
- [Joomla](https://php2shell.fyi/platforms/joomla): System Information and supported PHP for Joomla 5 and 6
- [Magento and Adobe Commerce](https://php2shell.fyi/platforms/magento): PHP per Magento release and cloud notes
- [Laravel](https://php2shell.fyi/platforms/laravel): PHP for Laravel 12 and 13, queue workers and Octane
- [Symfony](https://php2shell.fyi/platforms/symfony): PHP for Symfony 8.1, 7.4 and 6.4, and the exposed profiler risk
- [MediaWiki](https://php2shell.fyi/platforms/mediawiki): Special:Version and PHP ranges for MediaWiki 1.43 to 1.46
- [phpMyAdmin](https://php2shell.fyi/platforms/phpmyadmin): supported PHP and why the panel should not be public
- [Moodle](https://php2shell.fyi/platforms/moodle): where Moodle shows PHP and which fixed PHP each version supports
- [Nextcloud](https://php2shell.fyi/platforms/nextcloud): PHP version, AIO and Docker notes
- [WHMCS](https://php2shell.fyi/platforms/whmcs): PHP ranges, ionCube Loader and update order
- [cPanel, Plesk and shared hosting](https://php2shell.fyi/platforms/cpanel): PHP version in the panel, EasyApache 4 builds, a message for your host
- [Plesk](https://php2shell.fyi/platforms/plesk): PHP version and handler per site, Plesk PHP builds, updates and PHP-FPM restart
- [DirectAdmin](https://php2shell.fyi/platforms/directadmin): PHP version per domain, CustomBuild updates, PHP-FPM restart
- [aaPanel](https://php2shell.fyi/platforms/aapanel): PHP version per site, App Store updates, PHP-FPM restart
- [For site operators](https://php2shell.fyi/about): what the checker sends, how often, how to block it, privacy
- [Updates](https://php2shell.fyi/updates): dated changes to the rules and guides

## Data

- [rules.json](https://php2shell.fyi/rules.json): machine-readable rules: fixed versions, support end dates, CVEs, and verified Ubuntu, Debian and RHEL fixed packages
- [php.net advisory](https://www.php.net/archive/2026.php#2026-10-21-5): the primary source
- [php2shell.com](https://www.php2shell.com/): the researchers' site