PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an attacker run code on your server without logging in, and attacks are already happening. We check your site, tell you exactly where you stand, and quote the fix.
Audit for only 29 € + VAT, one-time payment
Want the whole server checked? Full security audit for 199 € + VAT
PHP2Shell is the name for two critical flaws in the PHP engine itself, disclosed on 20 October 2026 and patched on 21 October 2026. Because they sit in PHP, not in WordPress, a plugin or your own code, every site running on a vulnerable PHP build is exposed, whatever the application.
The attack is a specially crafted HTTP request. PHP processes it before any of your application code runs, so logins, CAPTCHAs and security plugins do not stop it. Researchers have confirmed unauthenticated remote code execution against WordPress, Drupal, Joomla and Magento sites. The first exploitation attempts were seen on 17 October, before the public announcement, and attacks have grown since.
When PHP runs out of memory while it is still reading a POST request, it leaves a half-built entry behind. Request cleanup then treats that entry as valid, and the attacker controls what it contains, which can be turned into running their own code.
State left over from one request can point to memory that has already been freed, and a later request on the same PHP worker uses it. This leaks memory contents and can lead to code execution. It is reachable through session upload progress, which is on by default.
Any PHP installation that serves web requests is in scope: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. Check the PHP version that actually serves your website against this table.
| PHP branch | Status | Safe version |
|---|---|---|
| PHP 8.5 | Vulnerable before 8.5.12 | 8.5.12 or newer |
| PHP 8.4 | Vulnerable before 8.4.27 | 8.4.27 or newer |
| PHP 8.3 | Vulnerable before 8.3.36 | 8.3.36 or newer |
| PHP 8.2 | Vulnerable before 8.2.35 | 8.2.35 or newer |
| PHP 7.4 – 8.1 | Vulnerable, no official release (source backports only) | Upgrade to 8.2+ or a vendor-patched package |
| PHP 5.4 – 7.3 | Vulnerable, end of life, no fix | Upgrade required |
The version number alone can mislead. Linux distributions often backport fixes without changing it, the PHP you see on the command line can differ from the one serving your site, and shared hosting may run several versions at once. The audit settles it for your exact setup.
An engineer checks your website by hand, not with an automated scanner, and sends you a written report in plain language.
Enter your website's domain and pay for the audit you chose (29 € or 199 € + VAT) by card, bank link, PayPal or crypto.
An engineer gets in touch within 2 working hours (Mon–Fri 9:00–18:00) to agree on access.
You get the findings in plain language and an estimated price for the fix. You decide whether we do it.
Works for any website, wherever it is hosted. You do not need to be our hosting customer.
A focused check for CVE-2026-109618 and CVE-2026-109619.
Everything in the PHP2Shell audit, plus your whole server and your site's code.
Every server is different, so the fix is priced individually. After the audit you get an approximate price and we start only when you agree.
Hosted somewhere you cannot change PHP yourself? We tell you exactly what to ask your provider, or help you move.
Updating PHP is the only complete fix. Until you can update, the PHP team's interim guidance is:
memory_limit=-1 at server level, so applications cannot override it, and limit request size at the web server or proxy. This blocks the known path for CVE-2026-109618.session.upload_progress.enabled=0, and on PHP 8.5 also fatal_error_backtraces=0, for CVE-2026-109619.A WAF such as Cloudflare helps against known attack patterns, but only for traffic routed through it. It is a stopgap, not a fix. If you are unsure whether these settings took effect, or whether someone got in before you changed them, that is exactly what the audit checks.