Fencer

CVE-2026-109618 · CVE-2026-109619 · CVSS 9.2

Is your site exposed to PHP2Shell?

Two critical flaws in core PHP allow unauthenticated remote code execution. Check what your server reveals in under a minute, without crashing anything.

  • Non-destructive: no out-of-memory payloads
  • No signup needed
  • Fixed in PHP 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35

Check your website

Use a public URL. Include the PHP path you want to check. Private networks are blocked.

How the check works

A small check. A clearer picture.

A handful of small requests, three phases. Nothing that comes close to PHP’s memory limit.

01 · Fingerprint

Is this path running PHP?

We read headers, cookies and page markers (X-Powered-By, PHPSESSID, WordPress, Drupal, Joomla, Laravel, Magento) to find PHP and, if it’s exposed, its exact version.

02 · Multipart

How does your edge react?

We send a tiny upload-progress multipart request, the shape the published exploit starts with, next to a plain one, and report whether your WAF or CDN rejects it.

03 · Verdict

Where you stand

We compare any exposed version against the fixed releases and flag the indicators researchers published, such as leaked memory-limit errors or malformed PHPSESSID cookies.

What to do now

Patch first. Mitigate only if you can’t.

  1. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro’s patched package.
  2. Restart PHP-FPM and Apache, and rebuild container images. A patched binary on disk doesn’t help if the old one is still in memory.
  3. On PHP 8.1 or older, get a backported build from your vendor (or the PHP team’s source backports for 7.4–8.1) and plan the move to a supported branch.
  4. Hunt in your logs from before 20 October for large multipart POSTs, “Allowed memory size exhausted” fatals, and worker crash bursts.

Interim mitigations, not fixes

  • Set memory_limit=-1 administratively (php_admin_value), the primary mitigation in the PHP advisory, and restart every worker
  • session.upload_progress.enabled=0 in php.ini or the pool config; ini_set() and .user.ini don’t work
  • On PHP 8.5: fatal_error_backtraces=0
  • Set post_max_size to 8M (32M if you need uploads) and cap request size, fields, parts, headers and nesting at your proxy, including requests without a Content-Length
  • Don’t use RLIMIT_AS or RLIMIT_DATA: they trigger the vulnerable path

A little context

What we check, and what you should know.

What is PHP2Shell?

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical (CVSS 9.2) memory-safety flaws in core PHP disclosed on 21 October 2026. An out-of-memory error during request startup can leave stale state behind, and a later request on the same worker can use it for remote memory disclosure or unauthenticated code execution. Because the bug is in PHP itself, a plain “Hello World” app on an affected version is exposed. WordPress, Drupal, Joomla and anything else on PHP-FPM, mod_php, php-cgi, FrankenPHP or LiteSpeed can be hit.

Which versions are fixed?

PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, per the PHP security advisories. Wiz Research reports that versions back to 5.4 are affected. 8.1 and older get no new releases; the PHP team published minimal source backports for 7.4, 8.0 and 8.1, and some LTS vendors ship fixed packages. Distro packages (Debian, Ubuntu, RHEL, Alpine) received the patches in advance and often keep the version number, so a remote check can’t see the fix: check your package changelog.

Will this check harm my website?

No. Unlike an exploit, we never push PHP toward its memory limit: our largest request is under one kilobyte. That can’t trigger the out-of-memory condition both CVEs depend on, crash a worker, or leave state behind. We send one GET (plus up to three redirects) and two small POSTs to the URL you enter. Only test sites you own or are authorized to test.

Does a “patched” or “no PHP found” result mean I’m safe?

No. Headers can be stripped, cached or wrong, and one path may not represent your whole stack. A remote check can’t see patch status the way your package manager can. Run php -v (and restart PHP-FPM or Apache after patching) on every host, including container images.

My WAF blocks the request. Am I protected?

Not necessarily. Several providers shipped rules for known exploit patterns, which buys time, but the advisories describe several ways to reach the bug and a WAF isn’t a fix. A rejected probe tells you your edge filters this one shape of request. Patch the PHP behind it.

What do you do with my data?

We don’t keep a database of results; the report lives in your browser tab. When a check finishes, our team gets a note with the website you checked (without its query string), the result, and the network and country you checked from, so we can follow up with the site’s owner. We don’t include your IP address. Visitors in the EU, the UK and Switzerland are asked before any analytics or marketing cookies run; everyone else can turn them off under Cookie settings in the footer. Avoid putting secrets in the URL.

Sources:PHP security announcement,Wiz Research,PHP advisory (CVE-2026-109618),PHP advisory (CVE-2026-109619),Armis,PHP ChangeLog.

Find the next PHP2Shell before it finds you.

Fencer scans your code, cloud and domains continuously, and tells you what to fix first.

Free TrialBook a Demo