Check your website for PHP2Shell.
See the PHP version your website exposes, whether it needs attention, and what to do next.
Free PHP2Shell checker
Enter your domain. BlackSight checks the homepage over HTTPS and HTTP for a public PHP fingerprint.
Ordinary web requests only. We read response headers, without submitting payloads or running a full scan. Check websites you own or have permission to assess.
We log the checked domain, your IP address, and outcome and send the result to the BlackSight team. Privacy policy
Understand the risk
What is PHP2Shell?
PHP2Shell refers to two critical vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution. PHP published fixes on October 21, 2026.
- CVE-2026-109618 · Out-of-memory corruption
- Interrupted initialization can leave invalid request data that PHP later uses during cleanup.
- CVE-2026-109619 · Stale global state
- Request-owned state can outlive its memory and be reused by a later request.
PHP's advisory covers web-serving installations including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Actual exposure depends on configuration and application behavior. WordPress, Drupal, Joomla, and Laravel sites should have their PHP runtime checked.
Read PHP's official security advisoryWhich PHP versions need an update?
Official fixed releases, by branch. Use the fixed version or a later stable release in the same branch.
| Branch | Needs update | Fixed release |
|---|---|---|
| PHP 8.2 | Before 8.2.35 | 8.2.35 |
| PHP 8.3 | Before 8.3.36 | 8.3.36 |
| PHP 8.4 | Before 8.4.27 | 8.4.27 |
| PHP 8.5 | Before 8.5.12 | 8.5.12 |
| 8.1 and older | Outside upstream support. Upgrade or confirm a vendor fix. | |
Vendor backports matter. A distribution or hosting provider may apply a fix while retaining an older PHP version number. Confirm the exact package against your vendor's advisory before drawing a conclusion.
Sources: PHP advisory for CVE-2026-109618 and CVE-2026-109619.
Your next steps
How to remediate PHP2Shell
Start with the PHP runtime that serves your website. Updating a CMS, hiding a version header, or enabling a firewall does not replace the PHP fix.
-
Confirm what is actually running
Check your hosting panel or ask your administrator for the PHP version and package used by every web server, pool, and container. The command-line PHP version may differ from the website's runtime. Avoid publishing a phpinfo page.
-
Install a release containing the fixes
Back up and check application compatibility. Install PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a later stable release in the same branch, or a vendor-confirmed patched package. On shared hosting, ask your provider to apply and confirm the update.
-
Restart and verify every instance
Restart the relevant PHP-FPM pools, Apache/mod_php services, containers, and other long-running PHP workers. Verify the installed package and running web runtime on every instance, then test critical application flows.
-
Review possible exposure
Review access and error logs, unexpected files, accounts, and outbound connections. Patching does not remove an existing compromise. If you find suspicious activity, preserve evidence and get incident-response help.
-
Set up ongoing checks with BlackSight
Create your scanner.blacksight.io account, verify your website, run the available security checks, and set a recurring schedule supported by your plan. Start with the free plan and review findings regularly.
-
Keep patching and monitoring separate
Use BlackSight to track broader website security findings over time. Your hosting provider or administrator remains responsible for PHP updates. Neither this checker nor a full scan certifies that the runtime fix is deployed.
BlackSight can help
Affected, or still unsure?
Talk to us about confirming your exposure, planning remediation, and arranging a manual security assessment. Share your checker result and what your hosting provider has confirmed so we can discuss the right next step.
contact@blacksight.io +1 615-200-7888
Make this your first check, not your last.
Build a broader view of your website's security with BlackSight. Create an account, verify your domain, and get started with the checks available on the free plan.
Set up BlackSight freeNo credit card required. Plan limits apply.
Read the checker and scanner setup guidePHP2Shell checker FAQ
What is PHP2Shell?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can allow unauthenticated remote code execution. PHP released fixes on October 21, 2026. Exposure depends on the runtime, configuration, and reachable application behavior.
How can I check my website for PHP2Shell?
Enter your website in BlackSight's free PHP2Shell checker. It makes ordinary HTTP and HTTPS requests and compares any PHP version disclosed in response headers with PHP's fixed releases. It does not attempt exploitation. Confirm the actual web-serving runtime and package patch status with your hosting provider or administrator.
Is my website affected by PHP2Shell?
An unpatched PHP runtime in an affected branch needs an update. BlackSight shows 'Affected by PHP2Shell' when a reported version falls in the affected upstream range. Hidden or unrecognized versions give an inconclusive result. Confirm the actual web runtime and any vendor-backported fix with your host; public headers do not prove exploitability.
Which PHP versions fix PHP2Shell?
PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain the fixes. Use those releases or a later stable release in the same branch. Older releases in those branches need updating unless a vendor has backported the fixes. PHP 8.1 and older are outside upstream support; migrate to a supported branch or obtain a confirmed vendor fix.
Why can't the checker detect my PHP version?
Many websites hide PHP headers, and a CDN, reverse proxy, cache, or firewall may answer instead of PHP. A site may also be unreachable or redirect beyond the checked hostname. An inconclusive result does not mean PHP is absent or that the website is safe. Check the web runtime in your hosting panel or ask your provider.
Does a reported fixed version mean my website is secure?
No. Public headers can be stale, modified, or supplied by a proxy. Different servers or paths may run different PHP versions, and vendor backports can retain an older version number. This checker reports version evidence only; it cannot confirm exploitability, a completed patch deployment, or whether a site has been compromised.
Does updating WordPress fix PHP2Shell?
Updating WordPress, Drupal, Joomla, a plugin, or a theme does not update the PHP runtime. Your host or administrator must install a PHP build containing the fixes and restart the relevant PHP processes. Keep the application and its extensions updated as a separate step.
Is the BlackSight PHP2Shell checker free?
Yes. This public version check is free and requires no account. It checks public HTTP and HTTPS response headers without an exploit or a full vulnerability scan. Rate limits apply. BlackSight also offers an account-based scanner for ongoing website security checks.
Can BlackSight help me remediate PHP2Shell?
Contact BlackSight at contact@blacksight.io or +1 615-200-7888 to discuss validation, remediation planning, and manual security assessment. Start by updating PHP, restarting its processes, and verifying the deployed package. Then create a BlackSight scanner account and verify your website for ongoing checks. Automated scanning does not install the PHP fix or certify that remediation is complete.