SCANMYHOST / PHP2SHELL CHECK

PHP2Shell check: is your website exposed?

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an unauthenticated attacker run code on servers where PHP handles web requests. Enter your domain for a passive external check.

Fixed releases: 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
Unsupported: PHP 8.1 and older receive no fix
Impact: Remote code execution without authentication

REMEDIATION

How to fix PHP2Shell

Upgrade to the fixed release of your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12), or install your distribution’s security update.
PHP 8.1 and older are no longer supported and will not receive a fix. Move to a supported branch.
Restart PHP-FPM and the web server after upgrading so the new version actually serves requests.

Interim mitigations

If you cannot upgrade immediately, reduce exposure until you can:

Lower memory_limit and post_max_size to what your application needs.
Set session.upload_progress.enabled=0.
On PHP 8.5, set fatal_error_backtraces=0.
Restart PHP-FPM and the web server so the settings take effect.

Interim mitigations do not replace the patch.

Sources

Verify the version on your server

If the external check could not see the version, or the version comes from a distribution package, the definitive answer is on the server.

Installed PHP version
php -v
Debian / Ubuntu packages
dpkg -l 'php*' | grep -E '^ii'
RHEL / AlmaLinux / Rocky packages
rpm -qa 'php*'
PHP-FPM used by the web server (the binary may be named php-fpm8.3 etc.)
php-fpm -v

Distribution advisories

Distributions may add the fix without changing the version number; compare your package version with the version in these advisories.

Monitor all your servers continuously

SCANMYHOST

Keep watching after the patch.

Create a free ScanMyHost account to monitor your external perimeter continuously, not just once.

Create a free account