PHP2Shell · CVE-2026-109618 · CVE-2026-109619
Which PHP version does your website report?
On October 21, 2026, the PHP project fixed 2 critical vulnerabilities that CISA refers to as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They allow code to run on a server without logging in. Enter a domain and we will show you which PHP version your website reports in its headers and whether it matches the fix.
How to read the result
- An old number does not prove a vulnerability. Many hosting providers apply the fix and keep the original version number.
- A current number is a good sign, not proof. The header can be changed by the server configuration or a device in front of it.
- When the website does not report a version, we know nothing. That is the case for most websites: of the 8,171 Slovak company websites that responded to us on October 31, 2026, only 332 reported a PHP version in the header (4.1%).
Which versions contain the fix
| Branch | Fixed from |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
The PHP project no longer maintains PHP 8.1 and older. Some Linux distributions and extended support vendors add the fix themselves, so check with them.
What to do
- Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or to your vendor’s fixed package.
- Ask whoever runs the service which PHP version it uses and whether it contains the fixes for CVE-2026-109618 and CVE-2026-109619.
- Stop announcing the version:
expose_php = Offinphp.iniremoves the X-Powered-By header.