The latest articles on DEV Community by Lunover (@lunover). https://dev.to/lunover https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4198933%2Fc12fb790-edff-4187-8d62-64ae48c415d3.png https://dev.to/lunover en Lunover Wed, 21 Oct 2026 17:53:01 +0000 https://dev.to/lunover/we-built-a-php2shell-exposure-check-and-update-now-2817 https://dev.to/lunover/we-built-a-php2shell-exposure-check-and-update-now-2817 <p>PHP released fixes today for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They affect PHP installations serving web requests, including sites using PHP-FPM and mod_php.</p> <p>We built a <a href="https://www.lunover.com/php2shell-checker/" rel="noopener noreferrer">PHP2Shell exposure checker</a> to help site owners start checking. Enter a site URL and it examines remote signals, then gives a result and next steps.</p> <p>Remote checks have limits. If the result is inconclusive, ask your host which PHP package serves the live site and whether it contains fixes for both CVEs. A CDN response or PHP version header cannot confirm the origin is patched.</p> <p>PHP lists these first fixed upstream releases:</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Branch</th> <th>Fixed release</th> </tr> </thead> <tbody> <tr> <td>PHP 8.2</td> <td>8.2.35</td> </tr> <tr> <td>PHP 8.3</td> <td>8.3.36</td> </tr> <tr> <td>PHP 8.4</td> <td>8.4.27</td> </tr> <tr> <td>PHP 8.5</td> <td>8.5.12</td> </tr> </tbody> </table></div> showdev php security webdev