What is PHP2Shell (CVE-2026-109618 & CVE-2026-109619)?

PHP2Shell refers to two critical core PHP Remote Code Execution vulnerabilities (CVE-2026-109618 involving out-of-memory corruption and CVE-2026-109619 involving stale global state across worker requests), rated CVSS 9.2 and patched on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Does this PHP2Shell security checker send exploit payloads to my website?

No. The DigVibes online vulnerability scanner is 100% passive and non-destructive. It inspects public HTTP headers, TLS certificates, SAPI footprints, and security policies without sending malicious crash probes.

How can I check my website for vulnerabilities if Cloudflare hides my PHP version?

Run the URL scan first to audit your TLS, WAF, cookies, and HTTP security headers. Then enter your internal PHP version (from WordPress Tools > Site Health > Info > Server or php -v) in the Manual Version Check bar to verify PHP2Shell patch compliance and export a complete PDF audit report.

Which PHP versions fix PHP2Shell?

Official fixed releases published on October 21, 2026 are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. PHP 8.1 and older branches are End-of-Life and require upgrading to a supported branch or verified vendor backports.

✳ FREE · PASSIVE CVE AUDIT · PDF REPORT

Free online PHP2Shell security checker & website vulnerability scanner.

Scan any website for PHP2Shell exposure (CVE-2026-109618 & CVE-2026-109619), SSL/TLS configuration, CMS footprints, and HTTP security headers. Non-intrusive site security test with instant branded PDF audit report download.

Zero exploit payloads (100% safe)
CVE-2026-109618 & 109619 check
SSL & Security Headers audit
Instant PDF report export

PHP2SHELL SECURITY AUDIT STUDIO ↳ Non-destructive live assessment

Quick test:

What Is PHP2Shell & How Our Online Vulnerability Scanner Works

PHP2Shell is the industry name for two critical Remote Code Execution (RCE) vulnerabilities in core PHP — CVE-2026-109618 (out-of-memory corruption during partial request initialization) and CVE-2026-109619 (stale global state persisting across worker requests). Disclosed and patched on October 21, 2026 with a severity score of CVSS v4.0 9.2 (Critical), unpatched PHP deployments—including exposed WordPress, Drupal, and legacy Apache mod_php hosts—require urgent patching.

When you run a site security test using the DigVibes PHP2Shell security checker, our non-destructive online website vulnerability scanner performs a multi-layer passive audit: inspecting exposed PHP version banners against the official fixed thresholds, validating your SSL/TLS certificate chain, detecting CMS and session cookie hardening, and auditing six core HTTP security headers before compiling a downloadable DigVibes PDF website security audit.

Official PHP2Shell Fixed Releases Matrix (October 21, 2026 Advisory)

Use this reference table when you scan a website for vulnerabilities or verify your server runtime manually:

PHP Branch	Patched Version	PHP2Shell Status & Action Required
PHP 8.5	`8.5.12` or newer	Protected: Upgrade any `8.5.0 – 8.5.11` build to `8.5.12+` and restart PHP workers.
PHP 8.4	`8.4.27` or newer	Protected: Upgrade any `8.4.0 – 8.4.26` build to `8.4.27+` and restart PHP-FPM / Apache.
PHP 8.3	`8.3.36` or newer	Protected: Upgrade any `8.3.0 – 8.3.35` build to `8.3.36+` (or verify OS vendor backport).
PHP 8.2	`8.2.35` or newer	Security Fixes Only: Update to `8.2.35+` immediately and plan migration to PHP 8.4+.
PHP 8.1, 8.0 & 7.x	End-of-Life (EOL)	Critical Risk: No official binary updates. Migrate to PHP 8.3.36+ or 8.4.27+ unless covered by verified LTS vendor patches.

How to Check WordPress Site for Vulnerabilities & Hidden PHP Versions

Many security-hardened hosts and Cloudflare-proxied domains strip the X-Powered-By header. While hiding server banners improves hygiene during a public website vulnerability scan, a hidden version does not guarantee your backend PHP runtime is patched. Follow these steps to check security of website deployments privately:

WordPress Site Health Check: Sign in to your WordPress dashboard, open Tools → Site Health → Info → Server, copy the exact PHP version number, and paste it into the Manual Version Check bar above to generate your updated PDF report.
Linux / macOS / Docker CLI Audit: Run the command below to verify the exact PHP binary and build date on your server or container:

php -v && php -i | grep -E "PHP Version|Server API|session.upload_progress.enabled"

On Ubuntu, Debian, RHEL, or CloudLinux servers where package managers backport security patches without bumping the upstream version number, verify the changelog directly for both CVEs:

apt-cache policy php-fpm || rpm -q --changelog php-common | grep -E "CVE-2026-109618|CVE-2026-109619"

Why Run a Regular Free Online Vulnerability Scan?

Using a free website vulnerability scanner online helps developers, agencies, and store owners spot misconfigurations early. Alongside checking PHP2Shell patch thresholds, every DigVibes web application security scanner audit verifies HTTPS enforcement, HSTS readiness, clickjacking protection (X-Frame-Options / CSP), MIME-sniffing defenses, and session cookie flags—giving you an executive-ready PDF report bearing your timestamp and audit ID.

Frequently Asked Questions

What is PHP2Shell and why is it critical?

PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, two critical memory-safety flaws in core PHP rated 9.2 (CVSS v4.0). Updating PHP to the October 21, 2026 security releases eliminates both flaws at the runtime level.

Is this online website security scanner safe to run on production sites?

Yes. The DigVibes PHP2Shell security checker performs a safe, passive inspection of standard HTTP headers, TLS certificates, and public page metadata—identical to a normal browser visit.

Does updating WordPress or installing a security plugin fix PHP2Shell?

No. PHP2Shell resides in the underlying PHP engine itself, not inside WordPress themes or plugins. You or your hosting provider must update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (and restart PHP-FPM / Apache workers) to remediate the flaw completely.

Can I download and share the website security audit PDF report?

Yes. Click the "Download PDF Report" button after any scan to generate a clean, multi-section PDF document complete with DigVibes branding, your unique Audit ID, CVE status, SSL details, HTTP header checklist, and step-by-step remediation instructions.