Skip to content
PHP2Shell: as a precaution, we are taking client sites offline until the 16:00 CEST security update is installed.
CodeIQ

Is your site running a vulnerable PHP version?

Enter your website. We read its PHP version and compare it with the versions PHP2Shell affects.

An ordinary request, just like a browser loading your page. We send nothing harmful and break into nothing.

By running the check you agree to the .

What is PHP2Shell?

PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both at the highest urgency (CVSS 9.2). They allow remote code execution: in the worst case someone on the outside runs their own code on your server. The flaw is in how PHP processes forms and uploads (multipart), which happens before your website or plugin runs. A security plugin, Laravel or WordPress will not stop it.

Which PHP versions are vulnerable?

PHP released the fix on 21 October 2026. You are safe from these versions onward; anything lower is vulnerable:

  • PHP 8.5 Safe from 8.5.12
  • PHP 8.4 Safe from 8.4.27
  • PHP 8.3 Safe from 8.3.36
  • PHP 8.2 Safe from 8.2.35
  • PHP 8.1 and older No official fix

What should you do?

  1. Establish which PHP version you run (you can check it above).
  2. Update PHP to the patched version and restart PHP-FPM, queue workers and anything else running on it.
  3. On PHP 8.1 or older, upgrade to a supported version or shield the site behind a reverse proxy or IP allowlist.
  4. After updating, check that nothing suspicious has come in.

Frequently asked questions about PHP2Shell

Is my website vulnerable to PHP2Shell?

It depends on your PHP version. If you run a version below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or PHP 8.1 or older, your site is vulnerable. Enter your website above and we read the version and compare it with the affected range.

Which PHP version do I need to be safe?

At least PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on your branch. PHP 8.1 and older get no official fix; those need an upgrade or shielding.

What are CVE-2026-109618 and CVE-2026-109619?

They are the two critical flaws behind the name PHP2Shell. Both allow remote code execution through the way PHP processes multipart forms and uploads. They score 9.2 out of 10.

Does my WordPress or Laravel security plugin protect me?

No. The flaw is in PHP itself, in the runtime, and is reached before your website or plugin runs. The only real fix is updating PHP or shielding the site.

I run PHP 8.1 or older. What now?

There is no official update for PHP 8.1 and older. You can upgrade to a supported version, or temporarily shield the site with a reverse proxy, a multipart filter or an IP allowlist. We are happy to help.

Can CodeIQ handle this for me?

Yes. We establish your version, update or shield, check whether anything came in, and take over management and hosting if you want. Call +31 10 318 0515 or book a call.

Good to know

PHP check terms

  • The passive check (level 1) is an ordinary request to your website, just like a browser. We send nothing harmful and break into nothing.
  • The deeper check (level 2) runs only on a domain you have verified via a DNS record, and only after you have given consent here.
  • In the deeper check we demonstrate that the vulnerable component is reachable and the version unpatched. We do not take over your server.
  • This vulnerability affects PHP memory. Touching the relevant path could, in the worst case, cause a brief hiccup in PHP. We therefore keep the check deliberately conservative.
  • We record who, which domain, which time and which IP, as proof the check was permitted. We use that data to help you and store it in our CRM.
  • Only have domains checked that you administer yourself. Testing someone else's domain without permission is not allowed.

Got a question?