Patch now — this is the fix
Upgrade PHP to the patched release for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer). Upgrading is the only measure that reliably closes the vulnerability. Everything else buys time, not safety.
Critical · CVSS 9.2Patched 21 Oct 2026
PHP2Shell: are you affected?
A critical remote-code-execution flaw in the PHP engine — CVE-2026-109618 and CVE-2026-109619 — was patched on 21 October 2026 across PHP 8.2 through 8.5. Check your version below, then patch.
Check a website for PHP2Shell
Enter a site and we read the PHP version it already reports in its response headers — the same request your browser makes. We don’t scan it or send anything beyond a normal page load.
Guidance reflects the PHP releases of 21 Oct 2026. Detection is best-effort from public headers and not a guarantee — exploitability can depend on configuration. When in doubt, upgrade.
Affected versions
Treat any pre-patch release on a supported branch as affected.
| PHP branch | Affected | Patched release |
|---|---|---|
| PHP 8.5 | below 8.5.12 | 8.5.12 |
| PHP 8.4 | below 8.4.27 | 8.4.27 |
| PHP 8.3 | below 8.3.36 | 8.3.36 |
| PHP 8.2 | below 8.2.35 | 8.2.35 |
| PHP 8.1 and earlier | end-of-life — unpatched | upgrade branch |
What actually protects you
Temporary mitigations — risk reduction, not protection
If you cannot patch within the hour, you can reduce exposure: keep PHP off the public internet behind a VPN or auth, block multipart/form-data at the web-server layer, and set session.upload_progress.enabled=0. Treat these as a stopgap — researchers expect ways around them — and upgrade as soon as you can.
Context from disclosure: the suspected entry point is PHP’s Session Upload Progress feature via multipart/form-data requests, though PHP has not confirmed the exact location or configuration conditions, and early public proof-of-concept code reportedly does not fire against released PHP. That uncertainty is itself a reason to patch rather than rely on a mitigation.
How did your team hear about this one?
XIBA is not a PHP scanner — it watches Microsoft 365 for account takeover, business-email-compromise and lookalike-domain attacks. But the gap PHP2Shell exposes is one XIBA closes directly: its threat-intelligence feed surfaces critical CVEs and exploited-in-the-wild alerts and routes them to your team — Teams, Slack or email — the moment they land. If a tweet three days late is how your team would have found out, that delay is the problem worth fixing.