Find your PHP exposure, then fix it with exact steps.
PHP2Shell is the name for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. Either can give an unauthenticated attacker remote code execution as your web worker. The PHP project shipped fixes on 21 October 2026. Apache mod_php carries the highest risk; PHP-FPM and other SAPIs are affected too.
PHP 8.1 and older receive no official fix. Latest releases shown from php.net.
$ shellproof version 8.1.33 PHP 8.1.33 CRITICAL PHP 8.1.33 is affected by a critical, actively exploited vulnerability and its branch (8.1) has no official fix. Migrate to a supported branch (8.5.12) now. Advisories: CVE-2026-109618 PHP2Shell critical [no official fix for branch 8.1] [exploited in the wild] CVE-2026-109619 PHP2Shell critical [no official fix for branch 8.1] [exploited in the wild] Upgrade to: 8.5.12 Branches in active support: 8.5 → 8.5.12 8.4 → 8.4.27 data: php.net · generated 2026-10-22
The same checks run locally in your browser — nothing is uploaded.
Six checks, one scan.
Run everything from the CLI on your server, or paste and drop files into the in-browser checkers. Each check reads only what you give it and reports findings with a fix.
PHP version & EOL
Paste php -v, phpinfo or an X-Powered-By header and get the verdict: patched, outdated, or end-of-life, with the version to move to.
php.ini & FPM config
Audit effective settings against the PHP2Shell interim mitigations and classic hardening — session.upload_progress, memory_limit, allow_url_include and more.
Composer dependencies
Match every package in composer.lock against the Packagist security-advisories API and get the safe version to update to.
Code & webshells
Scan application code for risky patterns and webshell signatures — PHP hidden in uploads, obfuscated loaders and files changed during the exposure window.
Exposed keys & wallets
Find private keys, seed phrases, RPC URLs with API keys and Solana keypairs in web-served files. Secrets are masked before they are ever shown.
Fix playbooks & mitigations
Pick your platform and SAPI for the exact upgrade, restart and verify commands, plus the interim mitigations to apply before you can patch.
What happened, with sources.
Only the facts the PHP project and the advisories state. Each item links to where it came from.
- Advance notice. The PHP project published "Upcoming Critical PHP Security Release," scheduled for 21 October 2026 at 14:00 UTC. Both vulnerabilities were rated CVSS v4.0 9.2. The team noted it could release earlier if details became public or active exploitation appeared. php.net/archive/2026.php
- Fixes released. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped as security releases, each fixing CVE-2026-109618 and CVE-2026-109619 — unauthenticated remote code execution. PHP 8.2 reaches end of life on 31 December 2026. php.net/archive/2026.php
- Impact confirmed. The advisory states complete remote code execution was validated over HTTP against Apache mod_php; no complete PHP-FPM exploit was demonstrated. mod_php carries the highest risk. GHSA-w8hw-w9fx-j79w
- 8.1 and older. No official release for PHP 8.1 and earlier. The PHP project published minimal source backports for 7.4, 8.0 and 8.1; some distributions and LTS vendors ship them. Move to a supported branch. GHSA-6wmf-4rv5-p3rp
RCE on the web worker means any key readable by that process can be stolen. Shellproof finds exposed keypairs and seed phrases, masks every secret, and lets you check read-only whether a hot wallet has moved funds — public addresses only.
On your server, or in CI.
One Python file, standard library only, no dependencies. It inspects the machine it runs on and the paths you give it, and sends nothing about you anywhere.
curl -O https://<your-host>/downloads/shellproof.pyz python3 shellproof.pyz scan .
python3 shellproof.pyz version 8.3.12 python3 shellproof.pyz scan /var/www --format md
python3 shellproof.pyz monitor /var/www \ --once --webhook "$SLACK_URL"
- PHP release and advisory announcements, October 2026 — php.net/archive/2026.php
- CVE-2026-109618 advisory — GHSA-w8hw-w9fx-j79w
- CVE-2026-109619 advisory — GHSA-6wmf-4rv5-p3rp
- Supported versions and support windows — php.net/supported-versions.php