Quick answer: Every PHP version is affected until patched. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor’s patched package), then restart PHP. Use Defense.com App Scanning and Vulnerability Scanning to find exposed PHP sites, and the manual checks below to confirm each server.
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in PHP. PHP released emergency updates to fix them, as they could let attackers run code on web servers remotely without logging in. Both have a CVSS v4.0 score of 9.2. The NCSC is encouraging UK organisations to take immediate action.
CVE-2026-109618: running out of memory can interrupt PHP while request data is only partly set up, and cleanup may then treat that invalid data as valid.
CVE-2026-109619: internal data from one request can survive after its memory is freed, and a later request handled by the same worker may use it.
Which PHP versions are affected?
All versions of PHP are affected.
PHP branch | First fixed version |
8.5 | 8.5.12 |
8.4 | 8.4.27 |
8.3 | 8.3.36 |
8.2 | 8.2.35 |
8.1 and older | No official release. Upgrade to 8.2 or later, or use a vendor backport |
Versions 8.1 and older are end of life with no planned upstream fix, though some distributions and LTS vendors offer backported fixes, and the PHP team has released minimal source patches for 7.4, 8.0 and 8.1.
Linux distributions often backport security fixes without changing the PHP version number. A server showing an older version may already be patched, so check your package changelog (step 3 of the manual checks below).
How to check using Defense.com
Scan your websites with App Scanning
From the my.defense.com dashboard, select Scanning, then App Scanning.
Click + Add Scan in the top right-hand corner.
Enter the URL of the website or API endpoint you want to scan.
Select a Minimum confidence level and a Scan template. The Base template is low-risk and suitable for live sites. Full is more thorough but may trigger security alerts, so use it with caution on production systems.
Click Add Site, then Start Scan.
Repeat for each public-facing website. For the best results, allow app.scanner.defense.com or 74.220.22.174 through your firewall.
For more detail, see How to get started with App Scanning.
Scan your external infrastructure with Vulnerability Scanning
From the my.defense.com dashboard, select Scanning, then Vulnerability Scanning.
Click Add Group in the top right-hand corner.
Enter a name for your scan group, then list the domains, IP addresses or IP ranges to scan, separated by commas (e.g. example.com,178.18.119.22).
Set a Start date, choose a frequency and tick Enable Schedule.
Click Add Group.
To scan straight away, click your group name, then Scan now. Once complete, click View scans to see your report.
For the best results, allow va.scanner.defense.com or 74.220.28.142 in your firewall and any intrusion detection systems. For more detail, see How to get started with external Vulnerability Scanning.
Review your results
Go to Threats and filter by scan type. Each threat includes remediation advice.
Our scanners identify PHP2Shell by detecting the PHP version your servers report. If your server hides its version, or your Linux distribution has backported the fix without changing the version number, results may be incomplete or flag a server that’s already patched. Use the manual checks below to confirm.
How to check your PHP version manually
Use these checks for servers our scanners can’t reach, such as internal or unmanaged servers.
1. Check the command-line PHP version
php -v
Your web server may use a different PHP binary, so continue to step 2.
2. Check the PHP version your web server uses
systemctl list-units --type=service | grep -i php php-fpm8.3 -v # replace 8.3 with the version listed
3. Check whether your distribution has backported the fix
Debian/Ubuntu:
apt changelog php8.1-common | grep -i "CVE-2026-109618"
RHEL/Rocky/Alma:
rpm -q --changelog php-common | grep -i "CVE-2026-109618"
Replace the package name with yours. If the CVE appears, the fix is installed.
4. Identify how your web server runs PHP
Apache (httpd -M on RHEL-based systems):
apache2ctl -M | grep -iE "php|proxy_fcgi"
php_modulemeans Apache runs PHP directly (mod_php). Restart Apache after patching.proxy_fcgi_modulemeans PHP-FPM. Restart PHP-FPM after patching.
Nginx:
grep -r fastcgi_pass /etc/nginx/
5. Don’t forget hosted and bundled PHP
If your site is managed by a hosting provider, check their status page or contact them. On WordPress, go to Tools > Site Health > Info > Server. Third-party products and appliances can bundle PHP too.
What to do if you’re affected
Update to a fixed version or your vendor’s patched package.
Restart PHP-FPM or Apache. The fix only applies once workers restart.
Re-scan to confirm.
If you can’t update yet, apply the PHP team’s temporary mitigations. If those can’t be applied quickly, consider taking the system offline until it’s fixed. ncsc
Check for compromise on anything left exposed: unexpected files in web directories, new admin accounts or unusual outbound connections. If you think a system has been compromised, click Incident Response in the left-hand navigation of your Defense.com account to raise an incident with our SOC.
FAQs
Can Defense.com detect PHP2Shell?
Yes. App Scanning and Vulnerability Scanning flag internet-facing servers running affected PHP versions. Because detection is version-based, confirm results with the manual checks above.
I’m a Defense.com MDR or SIEM customer. What else should I do?
Our SOC monitors your environment 24/7 for suspicious activity. If you’re concerned about a specific system, raise an incident using the Incident Response button in your Defense.com account.
Does hiding my PHP version protect me?
No. Settings like expose_php = Off hide the version from attackers but don’t fix the flaw.
Do I need to restart after updating?
Yes. Running PHP workers keep using the vulnerable code until restarted.
Is my WordPress site affected?
WordPress runs on PHP, so yes, unless your host has already patched it.