Poster of a container yard at night, worked by machines: a crane lowers a clean container into the gap in a stack while a tracked robot with a claw drags away the red container that was taken out, its padlock sprung open. A sign in the corner reads Arvion.

Free check· CVE-2026-109618· CVE-2026-109619

Is your PHPaffected by PHP2Shell?

Check whether the PHP behind your site is affected and what to change. Free, no signup.

Fix released · 21 Oct

Share this checkLinkedInX

Check your PHP

Try an example:
  • No signup.
  • What you paste never leaves your browser.
  • We never send attack traffic.

Nothing you paste leaves your browser. The check runs on this page. Not sure where to get this? On the server, run php -v. With Docker Compose, run docker compose exec wordpress php -v. On shared hosting, ask your host which PHP version your site runs.

Status at

PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619.

PHP released fixes on 21 Oct 2026. Update to the version on your branch's ticket below, or newer. PHP 8.1 and older get no official release; PHP published source patches for 7.4, 8.0 and 8.1, and some vendors ship backports.

Antonio Firmiano, CEO · Last updated

PHP versions and the fix

As of

PHP versions and the PHP2Shell fix
PHPAffectedFixed in
8.58.5.11 and older8.5.12
8.48.4.26 and older8.4.27
8.38.3.35 and older8.3.36
8.28.2.34 and older8.2.35
8.1 and older8.1.34 (last release)No official release

Source: PHP's advisory and releases feed. Also as versions.json.

What to do

Docker

PHP lives in the image. Once the image is rebuilt with the fix, pull it, restart, and check the version:

docker compose pull wordpress
docker compose up -d wordpress
docker compose exec wordpress php -v

If your compose file pins a digest or an old tag such as wordpress:6.4-php8.1-apache, change it to a current tag such as wordpress:php8.3-fpm before you pull. With your own Dockerfile, rebuild from the new base image:

docker compose build --pull
docker compose up -d

Updating WordPress or plugins from the dashboard does not update PHP.

Shared hosting

Ask your host:

Has PHP on my plan been updated for CVE-2026-109618 and CVE-2026-109619?

In cPanel, MultiPHP Manager shows the PHP version for each site.

Linux server

Install your distribution's PHP security update, restart PHP-FPM or Apache, then run php -v and check again.

php -v

Ubuntu, Debian, CloudLinux and other distributions often patch PHP without changing the version number. Their security notice for CVE-2026-109618 and CVE-2026-109619 is the answer for a distribution build.

How this check works

  • We check versions. The result says whether your PHP is affected by version. We don't try to trigger the flaws, because anything that proves they fire is an attack.
  • Paste mode runs in your browser. What you paste never leaves it.
  • Site mode, when it's live, makes one ordinary request to your site, the same as a browser visiting your homepage. It reads the X-Powered-By header your server already sends. PHP sends that header by default, and the official WordPress images leave it on.
  • We never send attack traffic or exploit code.
  • When a site hides its version, or the version comes from a distribution package, we say we can't tell and give you the command to run on the server.

Questions

What is PHP2Shell?

The name given to two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. PHP rates both 9.2 out of 10 (CVSS v4.0) and released fixes on 21 Oct 2026.

Does updating WordPress fix it?

No. The flaws are in PHP, the language WordPress runs on. Updating WordPress, plugins or themes doesn't change your PHP version. Your host, or whoever runs your server or containers, has to update PHP.

My site runs in Docker. Am I affected?

It depends on the PHP version inside your WordPress or PHP image. Paste your compose file above and we'll tell you which container has PHP and whether pulling the image is enough.

Which PHP versions are affected?

See the table at the top of this page. It lists each supported branch and the release that fixes it, copied from PHP's advisory.

Will PHP 7.4 or 8.1 get a fix?

PHP released no update for 8.1 and older. Its security team published minimal source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves, and some Linux distributions and LTS vendors ship backported fixes, so ask your host or vendor. Otherwise move to 8.2 or newer; 8.2 gets security fixes only until 31 December 2026.

Can I protect a server I can't update today?

Only an update fixes it. PHP's advisory lists measures that reduce specific attack paths, such as setting session.upload_progress.enabled=0 in php.ini and restarting every worker, and lowering post_max_size. PHP says these do not make an installation safe.

Is this the same as wp2shell?

No. wp2shell was a pair of flaws in WordPress itself (CVE-2026-63030 and CVE-2026-60137), made public on 17 July 2026. PHP2Shell is in PHP. Fixing one doesn't fix the other.

Does this check attack my site?

No. We make one ordinary request, the same as a browser visiting your homepage, and read the version your server already reports. We never send exploit code. What you paste is read in your browser and never sent anywhere.

Timeline (UTC)

  1. A post reports two upcoming PHP remote code execution disclosures. Details leak early.
  2. PHP posts an advance notice: two critical flaws, CVSS v4.0 9.2, fix on 21 Oct at 14:00 UTC.
  3. PHP releases the fixes: 8.5.12, 8.4.27, 8.3.36, 8.2.35.

Sources

Last updated . Found a mistake? Email [email protected] and we'll correct it.

Is PHP spread across your repositories?

One check covers one site. Your repositories pin PHP in Dockerfiles, compose files, CI images and composer.json. Book 20 minutes with the Arvion team to go through them.

Book 20 minutes