Security Alert
Free PHP2Shell Vulnerability Check
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) that allow unauthenticated remote code execution have been disclosed. Just enter your website address and STEALIEN will instantly check whether it runs a PHP version affected by PHP2Shell.
What is PHP2Shell?
Both vulnerabilities let attackers run commands on the server remotely without logging in or any user interaction, and the PHP security advisory rates them Critical.
- CriticalCVE-2026-109618
Corruption during out-of-memory (OOM) handling
When a request hits the memory limit, internal request data can be left partially initialized, and request cleanup may treat it as valid, leading to code execution. It can be triggered with large multipart requests.
- CriticalCVE-2026-109619
Reuse of freed global state
Internal state left by a previous request can survive after its memory is freed, and the next request handled by the same worker may use it, leading to code execution.
According to the advisory, Apache mod_php is directly affected by both vulnerabilities, and PHP-FPM, LiteSpeed (LSAPI), and FrankenPHP may be affected depending on configuration.
Affected and fixed versions
| PHP version | Vulnerable versions | Fixed versions |
|---|---|---|
| PHP 8.5 | Below 8.5.12 | 8.5.12 or later |
| PHP 8.4 | Below 8.4.27 | 8.4.27 or later |
| PHP 8.3 | Below 8.3.36 | 8.3.36 or later |
| PHP 8.2 | Below 8.2.35 | 8.2.35 or later |
| PHP 8.1 and earlier | All | No fix release (end of life) |
PHP 8.6.0 includes the fix starting from RC4. PHP 8.2 reaches end of life on December 31, 2026, so plan a move to a newer version as well.
Is a version check enough to feel safe?
STEALIEN's white-hat hackers assess vulnerabilities across your web and mobile services and guide you through remediation.