PHP vulnerability?Check your version.
Find your fix.PHP2Shell · CVE-2026-109618 / CVE-2026-109619 · PHP RCE · PHP security update
PHP vulnerability PHP2Shell: check your PHP version locally and find your platform fix for CVE-2026-109618 / CVE-2026-109619, PHP RCE and the PHP security update.
Check your PHP version
● Runs locallyWhat is PHP2Shell?
PHP2Shell refers to two critical PHP RCE issues addressed by the PHP project. This PHP vulnerability affects PHP installations serving web requests, including PHP-FPM and Apache. Apply a verified PHP security update for your runtime and confirm every worker has restarted.
Read the advisory summary →Fixed versions at a glance
Start with your current branch. An upstream PHP vulnerability fix and a vendor package revision can use different version numbers.
| PHP branch | PHP2Shell fix | Upstream status |
|---|---|---|
| PHP 8.5 | 8.5.12 ↗ | Active support |
| PHP 8.4 | 8.4.27 ↗ | Active support |
| PHP 8.3 | 8.3.36 ↗ | Security fixes only |
| PHP 8.2 | 8.2.35 ↗ | Security fixes only |
Branch status checked at 2026-10-21 15:26:08 UTC. PHP support policy ↗
See support dates & end-of-life branches →Find your platform guide
A PHP vulnerability update must match the source that installed your runtime. Choose the operating system, image or hosting panel you actually use.
If you cannot update immediately
Temporary mitigation is not a complete fix. A PHP vulnerability affecting web requests needs a verified runtime update. Have your administrator assess the availability and operational impact of these measures.
- PHP lists removing the memory limit, reducing accepted POST size, and disabling session upload progress as temporary measures. Removing the memory limit can exhaust host resources.
- For the branch covered by the advisory, PHP also lists disabling fatal-error backtraces. Correct recurring startup configuration warnings and restart all workers.
- Read the exact settings and limitations in the PHP security advisory before making configuration changes.
Questions before you update
Which versions include the PHP2Shell fix?
The upstream fix starts at 8.5.12, 8.4.27, 8.3.36, 8.2.35. A distribution can include a backport at a lower upstream number; compare the full package revision.
Why does my PHP version still look old after updating?
Distribution vendors often backport a PHP vulnerability fix without changing the upstream version. Match the installed package revision to your vendor advisory and confirm the web runtime.
Does updating command-line PHP also update my website?
It depends on your installed runtimes. The command line, PHP-FPM and a hosting panel can use different binaries. Verify the runtime serving each website after the PHP security update.
Do I need to restart PHP workers?
Yes. Follow the vendor restart procedure for all serving workers, including PHP-FPM, Apache and long-running application workers. A package update alone does not prove every process is running the new runtime.
What should I do with an end-of-life branch?
Confirm whether your vendor has a backport for this PHP vulnerability and plan a migration to a supported branch. This guide uses 8.4 as its default migration target; test application compatibility first.
Can this checker scan my website?
No. It only parses text you paste into this browser tab. It does not accept a website URL, contact your server or establish whether a server has been compromised.
Is this guide affiliated with the PHP project?
No. This guide is independent. PHP advisories and vendor documentation are linked in Sources.
Can temporary settings replace the update?
No. Read the temporary measures and availability tradeoffs in the PHP advisory. A verified runtime update is the complete fix.
Sources & verification
Checked at 2026-10-21 15:26:08 UTC. Vendor publication and installed runtime verification are separate checks.