PHP released fixes today for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They affect PHP installations serving web requests, including sites using PHP-FPM and mod_php.
We built a PHP2Shell exposure checker to help site owners start checking. Enter a site URL and it examines remote signals, then gives a result and next steps.
Remote checks have limits. If the result is inconclusive, ask your host which PHP package serves the live site and whether it contains fixes for both CVEs. A CDN response or PHP version header cannot confirm the origin is patched.
PHP lists these first fixed upstream releases:
| Branch | Fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Top comments (0)