Is your site exposed to PHP2Shell?

Enter your website and we check which PHP version it runs against the 21 October security fixes.

Read-only. We look at what your server already tells every visitor and never send an exploit or touch your files.

Check your PHP version by hand

When your server hides its version, this is the reliable way. Pick whichever access you have, then paste the version below.

1
Log in to your WordPress dashboard as an administrator.
2
Go to Tools → Site Health and open the Info tab.
3
Expand the Server section. The line PHP version shows exactly what your site runs, for example 8.3.12 (Supports 64bit values).
4
No Site Health menu? It was added in WordPress 5.2, so an older install is a sign PHP is old too. Use the hosting panel or SSH instead.

Paste the version you found

What PHP2Shell is

PHP2Shell is the name given to two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4. Together they can let an attacker with no login run code on the server. PHP shipped fixes on 21 October 2026.

The first bug corrupts request data when PHP runs out of memory partway through handling a request. The second leaves memory from one request lying around for the next request handled by the same worker. Both live in the PHP engine, not in WordPress or any plugin, so a fully updated WordPress site on an old PHP build is still exposed.

The PHP project says every installation serving web requests is affected, whether it runs through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed. Apache with mod_php carries the most risk, since a working exploit there fires before any application code runs.

How to fix PHP2Shell

The fix is a PHP update, never a WordPress or plugin update. Who installs it depends on who runs your server.

Option 1

Managed hosting or a hosted platform

WP Engine, Kinsta, WordPress.com, SiteGround, Hostinger, Bluehost, GoDaddy and most shared hosting run PHP for you. Hosts like these usually patch security releases themselves, often before customers ask.

Contact your host's support and ask whether your site's PHP includes the fixes for CVE-2026-109618 and CVE-2026-109619. If your dashboard lets you pick a PHP version, choosing a fixed one does the same job. The checker above names your host when it can tell.

Option 2

Your own VPS or cloud server

On a server you manage (DigitalOcean, AWS, Hetzner, Linode and similar), updating PHP is your job. Install a fixed release from the table below, then restart PHP so no worker keeps running the old build.

# Debian / Ubuntu (8.3 shown; use your version)
sudo apt update && sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm   # or apache2 for mod_php

# RHEL / AlmaLinux / Rocky
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm      # or httpd

On Docker, pull the latest php image for your branch and rebuild. On 8.1 or older there is no fixed release to install: move to 8.2 or newer, or use your distribution's patched build.

Which PHP versions are fixed

PHP branch	First fixed release	Status
8.5	8.5.12	Supported. Update.
8.4	8.4.27	Supported. Update.
8.3	8.3.36	Supported. Update.
8.2	8.2.35	Security fixes end 31 December 2026.
8.1, 8.0, 7.4	No release	Source backports only. Use a vendor build or upgrade.
7.3 and older, 5.x	No fix	Upgrade.

Linux distributions backport security fixes without changing the version number. A Debian or Ubuntu build reading 8.2.7 can be patched. Compare the full package version with your distribution's advisory, not the number alone.

How this checker works

By default PHP adds an X-Powered-By: PHP/8.x.y header to every page it serves. We request your homepage and a handful of addresses that PHP itself has to answer, such as /wp-login.php, /xmlrpc.php and a .php page that does not exist, because a CDN or page cache often strips the header from the homepage but not from those. We also look for a forgotten phpinfo() page.

Every request is an ordinary page view. Nothing tries the exploit, and nothing on your site changes. The verdict is only as good as the version your server reports, which is why the result shows where each version came from.

Plenty of well-run servers hide the version, as they should. When that happens the checker tells you so and walks you through finding it in WordPress, your hosting panel or over SSH.

If you cannot update today

The PHP project is clear that there is no complete workaround and updating is the only safe fix. These settings, from its advisory, close some of the attack paths in the meantime.

; Set in php.ini or the FPM pool, not with ini_set() or .user.ini
session.upload_progress.enabled = 0
post_max_size = 8M          ; 32M if the site takes uploads
memory_limit = -1           ; via php_admin_value, so apps cannot override it
fatal_error_backtraces = 0  ; PHP 8.5 only

Before you change memory_limit

Removing the memory cap stops one attack path but lets a single heavy request use all the memory on the server. Pair it with a container or cgroup memory limit, and do not use RLIMIT_AS or RLIMIT_DATA, which the advisory warns can trigger the bug. Restart PHP workers after any change.

Questions about PHP2Shell

01Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026, fix both CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and older receive no new releases from the PHP project. For those, install a patched build from your Linux distribution or LTS vendor, or upgrade to a supported branch.

02Is WordPress affected by PHP2Shell?

WordPress itself has no bug here, but every WordPress site runs on PHP, so a WordPress site on an unpatched PHP build is exposed. Updating WordPress core or plugins does not help. The fix is a PHP update, which on most hosting is a setting in the control panel or a request to your host.

03How do I check my PHP version in WordPress?

In the WordPress dashboard, go to Tools, then Site Health, open the Info tab and expand the Server section. The PHP version line shows the exact version serving your site. Site Health has been part of WordPress since version 5.2.

04Why can't the checker see my PHP version?

Many hosts switch off PHP's X-Powered-By header, and CDNs often strip it. That is good security practice, not a sign of a problem. It just means the version has to be read from inside: your WordPress admin, your hosting panel, or SSH.

05My version is below the fixed release. Am I definitely vulnerable?

On an upstream PHP build, yes. On a build from Debian, Ubuntu, Red Hat, AlmaLinux or a similar distribution, maybe not: distributions backport security fixes without changing the version number. Compare the full package version with your distribution's security advisory, or ask your host.

06Does this checker test the exploit against my site?

No. It makes ordinary page requests, the same a browser makes, and reads the PHP version your server already reports in its response headers. It sends no attack payload and changes nothing on your site.

Source: PHP security releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on php.net on 21 October 2026. Last checked 22 October 2026.