Which PHP versions are vulnerable to PHP2Shell?

Every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 is vulnerable. The vulnerability affects code going back to PHP 5.4, with nearly every version between 5.4 and 8.4 hit by at least one of the two CVEs. PHP 8.1, 8.0, 7.x and 5.x are end-of-life with no new releases from the PHP project, though OS vendors with extended support ship patched packages.

Is PHP2Shell only a problem for WordPress, Drupal and Joomla?

No. Those were demonstration targets used to show the vulnerability. The bug is in the PHP interpreter itself, so any site on vulnerable PHP—including Laravel, Symfony, Magento, Moodle, Nextcloud, custom code, or even a simple Hello World script—is exposed.

Is both Apache mod_php and PHP-FPM affected by PHP2Shell?

Both are affected. Apache with mod_php is the most clearly exploitable with RCE confirmed for both CVEs under default limits. On PHP-FPM, RCE via the session path has been validated and the out-of-memory path is vulnerable by analysis. FrankenPHP and LiteSpeed LSAPI are rated likely susceptible.

What can an attacker do if they exploit PHP2Shell?

An attacker can run code as the PHP worker user without logging in, read memory from other requests containing database passwords, API keys, session cookies and other sensitive data, and leak data quietly through memory disclosure without triggering process-monitoring tools.

What should I do if I think my site was compromised by PHP2Shell?

Preserve logs, patch or isolate the host by rebuilding from a clean image if possible, rotate every secret that PHP could see in memory, invalidate sessions, and review where those credentials grant access.

Security, Privacy & Compliance

PHP2Shell Response Guide

Free website checker and response guide for PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

0 votes. Log in to move PHP2Shell Response Guide up the list community voteFollow on the list. Log in to follow PHP2Shell Response Guide on the list

0community votes
6DR by Ahrefs no change since last check

Ahrefs Domain Rating listed 6 Nov 2026, relisted 1 Nov 2026.

A vendor-neutral guide to detecting and fixing PHP2Shell, two critical remote code execution vulnerabilities in PHP affecting versions from 5.4 onwards.

What it is

Screenshot of the PHP2Shell Response Guide homepage

PHP2Shell Response Guide: the homepage

PHP2Shell Response Guide is an independent, vendor-neutral resource for understanding and responding to PHP2Shell, two critical memory-safety vulnerabilities in the PHP interpreter (CVE-2026-109618 and CVE-2026-109619). The guide provides a free website checker to detect PHP2Shell exposure without exploit attempts, allows checking individual PHP versions, and offers actionable remediation steps.

The site consolidates information from PHP advisories, security researchers, and vendor analyses to help website owners determine if they are affected. It explains that the vulnerabilities allow unauthenticated attackers to execute code or read server memory on affected PHP installations, regardless of the application running on top. The guide covers which PHP versions are vulnerable, which server setups are exposed, and provides setup-specific instructions for WordPress, Drupal, Joomla, hosting providers, and other configurations.

Key features include a passive analyzer available as open-source TypeScript to integrate into other tools, detailed timelines of the vulnerability disclosure, explanations of temporary mitigations, and answers to frequently asked questions about detection and remediation.

Listed capabilities

Free website checker for PHP2Shell exposure without exploit attempts
PHP version checker that runs entirely in browser
Open-source TypeScript analyzer for integration into other tools
Handles hidden PHP versions and distro backports
Batch checking and CI integration for multiple sites
Detection results in JSON, CSV or table format
Vendor-neutral security advisory compilation
FAQs covering affected versions, server setups and mitigation strategies
Timeline of vulnerability disclosure and patch releases

Pricing

Pricing model: Freemium

Free website checker for single URLs and free PHP version checking tool in browser. Batch checker, CI integration, and offline analysis available for $99 one-time payment via Stripe.

Follow on the list. Log in to follow PHP2Shell Response Guide on the list

Follow PHP2Shell Response Guide for an email about each milestone, update and new product they post, in a daily summary.