PHP2Shell checker: is this site's PHP patched?

What is PHP2Shell?

PHP2Shell is the name for two flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Both are rated 9.2 on CVSS v4.0. PHP fixed them on October 21, 2026. PHP2Shell is a PHP flaw, not a WordPress one, so it applies to any site that runs on PHP.

watchTowr lists PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP as in scope. PHP's own advisory says there are no complete mitigations and that updating is the only safe choice.

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix PHP2Shell, all released on October 21, 2026. PHP 8.1 and older are end of life and got no new release. The PHP security team published source patches for 7.4, 8.0 and 8.1, so on those versions only the host can say whether the patch is applied. PHP published no fix for 7.3 and older, but vendors sell backports for some of them (Sansec lists Freexian, ZendPHP, TuxCare, Ubuntu Pro and CloudLinux), so there too only the host can say. The lasting fix is moving to a supported version.

What does this PHP2Shell checker read, and what can't it see?

The checker reads the PHP version from the X-Powered-By header the server sends with its home page and compares it with PHP's fixed releases. It cannot see backported fixes: Linux distributions patch PHP without changing the version number, so an old number is a reason to check, not proof of exposure.

Every scan gets one of 6 verdicts:

1. Older than PHP's fixed release: the version is below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 on its branch.
2. End of life: no new PHP release: PHP 8.1 or older. PHP published source patches for 7.4, 8.0 and 8.1 but no release, so only the host can say whether a patch is applied.
3. Distribution build: the version carries a package suffix such as -4ubuntu2.24, and only the package changelog shows whether the fix is in.
4. At or above PHP's fixed release: the version is 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer on its branch.
5. Version we can't compare: the server announces a PHP version this checker cannot compare with PHP's fixed releases, such as one without a patch number, a pre-release build or a newer branch.
6. PHP version not announced: the server hides it. That is the common case: of 32,347 sites in the WP Theme Checker index, 1.8% announce a PHP version.

The same scan also runs the WordPress theme checker, the plugin scan and a check of the WordPress core version.

What should you do if your PHP is behind?

Update PHP to the fixed release on your branch, or move to a supported branch, then restart every PHP worker so the new build loads. On a distribution build, the package changelog confirms the fix. The 5 steps:

1. Confirm the installed version on the server (php -v or the hosting panel), not just the header.
2. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or move off 8.1 and older to a supported branch.
3. Restart PHP-FPM, Apache or LiteSpeed so every worker runs the new build.
4. On a distribution build, search the package changelog for CVE-2026-109618 (zgrep on Debian and Ubuntu, rpm -q --changelog on the Red Hat family).
5. Treat PHP's partial mitigations (memory_limit=-1, session.upload_progress.enabled=0) as a stopgap; PHP says they do not make an installation safe.