intelsieve.com →
php2shell · oct 2026

Scan your domain for PHP2Shell

Enter a domain. We find every host on it and tell you which ones are running a vulnerable PHP version.

We check the PHP version each host reports. No exploit payloads, nothing that can harm your servers.

hosts

0

php

0

affected

0

fixed

0

unknown

0
hoststatusversionevidencefix

unknown does not mean safe. A host that hides its version could still be vulnerable — only php -v on the box confirms it. Distribution builds that backport the fix keep an old version string and will read as affected here.

Keep watching

Free weekly monitoring for every subdomain we find. Sign up with your work email — takes 30 seconds.

Monitor free

What it is

Two bugs in the part of PHP that reads form uploads

Every PHP request that carries a form body goes through the multipart parser before any application code runs. A crafted body with deeply nested field names makes that parser run out of memory (CVE-2026-109618), and the way PHP recovers from that failure leaves stale state behind that a second request can turn into code execution (CVE-2026-109619).

No login, no plugin, no bug in your application is needed. If a host runs an affected PHP and accepts a POST, it is reachable. With mod_php the exploit lands before the application ever sees the request, so WordPress, Drupal, Magento or Laravel being up to date does not help. Only the PHP runtime matters.

WordPressDrupalJoomlaMagentoLaravelSymfonyMediaWikiphpBBWHMCSanything else on PHP

Timeline

Days from leak to exploitation

20 Oct 2026Details leak ahead of the coordinated release. Working proof-of-concept code circulates the same day.
21 Oct 2026PHP publishes fixed releases for 8.2, 8.3, 8.4 and 8.5. Distributions begin backporting.
21–22 OctExploitation in the wild reported by several vendors. Government advisories follow.

What to do

Patch the runtime, restart the workers, verify from outside

  1. Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. On 8.1 or older there is no release: move to a supported branch, or take the host off the internet until you can.
  2. Restart PHP-FPM, Apache, LiteSpeed or whichever worker holds the old binary. A package update alone leaves the running process unpatched.
  3. Verify the version the live site reports, not the one the CLI prints. They differ more often than you would think. Run this check again.
  4. If you cannot patch today, put the host behind a login or an allowlist. WAF rules on nested multipart names slow the known exploit but do not close the bug.

How this check works

Version check only — no exploit payloads

We scan your domain's publicly discoverable hostnames to identify reported PHP versions and flag vulnerable hosts — without running exploits or sending payloads.

There are limits to what a passive check can tell. A host that hides its version reads as unknown, and a distribution build that backports the fix without changing the version string reads as affected. Both need a look from inside. Results are kept for 24 hours so a repeat check is free, and are not indexed.

References

Upstream is the source of truth

PHP releaseswatchTowr: exploitation in the wildwatchTowr: fixes and FAQImperva: technical analysisRecorded Future: two flaws explainedUbuntu: fixes availableCSA Singapore alert

Initial discovery is credited to the researcher LCFR in the PHP advisories.

results kept 24 hprivacy© 2026 Intelsieve