Affected and fixed versions
Source: php.net and the PHP security advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp), both published 21 October 2026.
- PHP 8.58.5.12Older than 8.5.12 is affected
- PHP 8.48.4.27Older than 8.4.27 is affected
- PHP 8.38.3.36Older than 8.3.36 is affected
- PHP 8.28.2.35Older than 8.2.35 is affected
- PHP 8.68.6.0RC4Pre-release only, not for production
- PHP 8.1, 8.0, 7.4 and olderno releaseAffected unless your vendor backported the fix
Using Ubuntu, Debian or RHEL packages? The version number may look old but already contain the fix. See the distribution backport table.
What the four results mean
Likely vulnerable
The site reports a PHP version older than the fix for its branch. Update and restart PHP.
Fixed version detected
The reported version includes the fix. Confirm on the server: headers can come from a proxy or cache.
Check your vendor
A distribution or vendor build, or an end-of-life branch. The number alone cannot tell; check the package changelog.
Next steps
Pricing
Checking one site, or a whole list, is free. The paid products are two one-time credit packs.
When the version is hidden or unclear
The assistant reads output you paste from the server, or a screenshot of your hosting panel, then writes a fix plan or a message to your host. The verdict still comes from our rules. One reply uses 1 credit. A reply that fails is not charged. Buy credits.
One-time payment, no subscription. Prices in USD; tax may be added at checkout. See the terms for refunds.
FAQ
What is php2shell?
php2shell refers to two critical PHP vulnerabilities disclosed on 21 October 2026: CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state). Both are rated CVSS v4.0 9.2 and can allow unauthenticated remote code execution.
Which PHP versions are fixed?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (and 8.6.0 RC4 for testers). Distribution packages can be fixed with an older-looking number, for example Ubuntu 22.04 8.1.2-1ubuntu2.28. See the fixed versions table.
Is PHP 8.1 affected? Is there a fix?
Yes, PHP 8.1 and older are affected and receive no official release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1, and some vendors (Ubuntu, Ubuntu Pro, CloudLinux and other LTS vendors) ship patched packages. Otherwise, upgrade to a supported branch.
Which servers are at risk?
php.net lists all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for Apache mod_php, where a request can trigger the attack before any application code runs.
The checker says the version is hidden. Am I safe?
Not necessarily. Hiding X-Powered-By (expose_php = Off) only hides the number; it does not fix anything. Run the self-check commands on the server, then paste the output into the assistant. One credit reads it; our rules give the verdict.
Do I have to pay to check a site?
No. The check on this page is free. Credits pay for the assistant that reads server output and writes a fix plan or a message to your host. A list of sites is a separate one-time bulk report.
Does this checker attack or scan my site?
No. It sends one ordinary GET request to your homepage (plus up to three redirects) and reads the response headers and the first 64 KB of HTML. It sends no exploit, no POST body and no uploads, and it does not probe other paths or ports.
Is there a workaround if I cannot update today?
Only partial ones. php.net recommends settings such as memory_limit=-1 and session.upload_progress.enabled=0 to reduce specific attack paths, but says updating is the only complete fix. See mitigation.