Updates

Every change to the checker rules and the guides, newest first. Each result names the rules it used, for example Rules of 22 October 2026.

Last updated 2026-10-23. Machine-readable rules: rules.json.

2026-10-23: wording corrections and the GH-24488 fix

No change to the checker rules or to the fixed package lists.

Not every distribution keeps the old PHP number. Ubuntu and the RHEL 9 default PHP do. Debian, Alpine, the RHEL modules and RHEL 10 ship the new upstream numbers. The guides now say "some" where they said "most" or "often".
The crash in 8.4.27 and 8.5.12 (GH-24488) now has a fix in the php-src source (commit f963484725, 22 October). No PHP release contains it yet.

2026-10-22: guides per distribution and panel

New guides: Ubuntu, Debian, RHEL, AlmaLinux and Rocky Linux, Alpine, Plesk, DirectAdmin, aaPanel and PHP 7.4, 8.0 and 8.1. Each shows how to see the PHP build that serves a site, how to update it and how to restart PHP.

Data changes on Linux packages, checked on the vendor notices the same day:

Rocky Linux 8 php:8.2 now has a fix: RLSA-2026:87073.
Alpine v3.22 now has fixed php82, php83 and php84 packages.
Red Hat's bulletin now lists RHEL 7 as affected by CVE-2026-109619. Red Hat's CVE data still says it is not affected. We now say that the sources disagree.

2026-10-22: optional active scan

Site owners can now run an active scan after they confirm that they own the site or are authorized to test it. Our scanner sends a few test requests that try to trigger the flaw, so it can interrupt PHP on that site. The result is an indicator, never a confirmation. The normal check is unchanged and stays passive. What the active scan sends.

2026-10-22: no more Server header

The checker runs on Cloudflare. Cloudflare replaces the Server header of every response the checker fetches, so results showed cloudflare for sites that do not use Cloudflare. The checker no longer reads or shows the Server header. We removed the Ubuntu release hint and the web server hints, because they came from that header. A site is now marked as behind Cloudflare only when its own response carries Cloudflare's error-logging header. PHP verdicts did not change: they come from X-Powered-By.

2026-10-22: rules 2026-10-22

The first rule set, based on the php.net advisory of 2026-10-21 and the two GitHub advisories. What it covers:

Fixed releases: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A lower patch level in the same branch shows as potentially affected.
PHP 8.6 test builds: 8.6.0RC4 has the fix. Earlier 8.6.0 alpha, beta and RC builds do not.
PHP 8.1, 8.0 and 7.4: no new release from the PHP project, only source backports. The checker cannot see a backport, so it asks you to confirm with your vendor.
PHP 5.4 to 7.3: the researchers say these are affected. Sources differ for some vendor builds, so the result says so.
PHP 8.2 end of life: security support ends on 31 December 2026. Results for 8.2 show this date.
Distribution builds: Ubuntu, the RHEL 9 default stream (8.0.30) and RHEL 8 (7.4.33) keep the old PHP number in fixed packages. For Ubuntu 26.10, 26.04, 24.04 and 22.04 and for RHEL 9 and RHEL 8, the result names the fixed package to compare with. Ubuntu Pro package suffixes for 20.04, 18.04, 16.04 and 14.04 are read when the header shows them. See Linux packages.
Platforms: the result names the platform it sees, such as WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, Symfony, MediaWiki, phpMyAdmin, Moodle, Nextcloud or WHMCS, and links to its platform guide.
Extra warnings: visible PHP error output, an exposed Symfony profiler and a public phpMyAdmin panel.

2026-10-22: launch

php2shell.fyi went live with the public checker and these guides:

What is PHP2Shell and the technical write-up
Fixed versions, how to check your PHP version and fixed Linux packages
Mitigations and the FAQ
Platform guides for WordPress, Drupal, Joomla, Magento, Laravel, Symfony, MediaWiki, phpMyAdmin, Moodle, Nextcloud, WHMCS and cPanel or Plesk hosting
For site operators: what the checker sends, how often, and how to opt out