Skip to content
PHP ships the fix today, 21 October at 14:00 UTC. Sansec expects mass attacks within 15 minutes of the release.Sansec’s research
php2shell.xyz
A free check by PXLCheck a domain
CVE-2026-109618 · CVE-2026-109619

Is your serveropen to PHP2Shell?

Two critical flaws let attackers run code on any server with PHP 5.4 or later, before your shop’s own code even loads. Enter a domain to see what its server gives away.

  • PHP 5.4 and later
  • Magento · Shopware · WooCommerce
  • CVSS 9.2

We only read what your server shows every visitor. No exploit code is sent.

php2shell.xyzReady

Six passive checks

  • Runs PHP—
  • PHP version—
  • Fix for this branch—
  • Shop platform—
  • WAF in front—
  • Way around the WAF—

Verdict

$ php2shell check

Enter a domain above. The check sends the same requests a browser sends when it opens the front page, and reads public DNS.

The check

Six things your server tells every visitor

We read the front page, its headers and cookies, and public DNS: what any browser or search engine sees. We never send exploit code and never log in.

  1. 01

    Does it run PHP?

    Headers, cookies and file paths that PHP leaves behind.

    X-Powered-By · PHPSESSID · *.php

  2. 02

    Which PHP version?

    Many servers print the exact version in a response header. When yours hides it, we say so.

    X-Powered-By: PHP/8.x.y

  3. 03

    Will that branch get a fix?

    PHP supports 8.2 and later. Servers on 8.1 or older get no official fix.

    8.2 · 8.3 · 8.4 · 8.5

  4. 04

    Is it a shop?

    Sansec names Magento, Shopware and WooCommerce stores explicitly.

    /static/ · /bundles/ · /wp-content/plugins/

  5. 05

    Is there a WAF in front?

    Cloudflare runs rules against the known exploits on every plan, free included. They buy time. They don’t fix PHP.

    server: cloudflare · cf-ray

  6. 06

    Can the WAF be skipped?

    DNS names that point straight at your server let an attacker go around the WAF. We look for them.

    mail. · ftp. · cpanel. · origin.

The flaw

Two holes in PHP itself, rated 9.2 out of 10

CVE-2026-109618 and CVE-2026-109619 let an attacker run their own code on your server. The attack reaches PHP before your application runs, so plugins, security modules and fixes in your shop’s code can’t stop it.

The technical details stay under embargo until the fix ships. A leaked screenshot of an exploit tool called PHP2Shell, credited to Calif.IO, claims it works against every PHP release from 5.4.0 on. watchTowr has confirmed the bugs are remote code execution.

Patching PHP is the only mitigation, says PHP core developer Gina Peter Banyard.

CVSS v4.0
9.2
Both flaws, rated by the PHP security team
Affected
5.4+
Every web server running PHP 5.4 or later
Official fix
8.2+
8.1 and older are left out
Mass attacks
15 min
After the release, Sansec expects
Timeline

From leak to fix in under two days

All times UTC, from Sansec’s running coverage. We update this page as the story moves.

  1. 20 Oct · 15:20A Hacker News post reports two upcoming PHP remote code execution disclosures.
  2. 20 OctPHP announces a critical security release. watchTowr confirms the leak.
  3. 21 Oct · 02:13PHP core developer Gina Peter Banyard says patching is the only mitigation.
  4. 21 Oct · 07:43Cloudflare reports early attacks and deploys WAF rules for every customer.
  5. 21 Oct · 08:48The PHP Foundation warns that Remi’s repository won’t carry the fix today.
  6. 21 Oct · 14:00PHP security release with the fixScheduled
What to do

Patch PHP. Everything else buys time.

Fix it at the infrastructure level. A flaw in PHP itself can’t be fixed from your shop’s codebase.

  1. 01

    Update PHP the moment the fix ships

    Install the 21 October release from your distribution, or build it from source. This is the only complete fix.

  2. 02

    On PHP 8.1 or older? Talk to your host today

    Those branches get no official fix. Ask your host to backport it, or move to 8.2 or later.

  3. 03

    Installed from Remi’s repository? Switch

    rpms.remirepo.net won’t have the fix on 21 October. Use your distribution’s packages or build PHP from source.

  4. 04

    Behind Cloudflare? Close the side door

    The WAF rules only protect a server that refuses connections that don’t come from Cloudflare. Lock your origin to Cloudflare’s IP ranges.

  5. 05

    Can you go offline for a day?

    Banyard calls that the most sensible option until the patched release is on your server.

Until you can patchphp.ini
session.upload_progress.enabled = 0session.use_strict_mode = 1

PHP-FPM, in every pool

php_admin_flag[session.upload_progress.enabled] = offphp_admin_flag[session.use_strict_mode] = on

No guarantee, and no effect when sessions live in Redis or the database. Reload PHP-FPM after the change.

Questions

Before you check

Is the check safe to run against my site?

Yes. We send the requests a browser sends when it opens your front page, and we read public DNS. We never send exploit code, never try to log in and never touch anything behind a login.

Why does it say “Check needed”?

Your server runs PHP but hides its version. That’s good practice, but it means nobody can tell from the outside whether the fix is installed. Ask your host which PHP version serves the site.

Doesn’t Cloudflare protect me?

Partly. Cloudflare’s CTO calls the rules a stopgap. Attackers who know your origin server’s IP address go straight around them, which is why the check looks for an exposed origin.

My host runs PHP for me. What do I ask them?

Which PHP version serves your site, whether the 21 October security release is installed, and when. On 8.1 or older, whether they will backport the fix. Every report has a message you can send them as it is.

Do you keep the domains people check?

The checker keeps each result in memory for a minute, so the report page can show it, and stores nothing on disk.