What is PHP2Shell?
Two critical PHP runtime flaws can permit unauthenticated remote code execution. PHP published fixes on 21 October 2026. The advisory concerns PHP serving web requests, including PHP-FPM and Apache mod_php.
PHP runtime security advisory
PHP2Shell.
Check your next step.
Find the public PHP signals your website reveals. Get a clear explanation of what they mean and what to ask your host.
CVE-2026-109618 & CVE-2026-109619
Source reviewed 22 October 2026
Source reviewed 22 October 2026
A public check can suggest exposure.
Only host or server evidence can confirm installed fixes.
01 / PUBLIC SIGNAL CHECKFree
- Validate the website addressPending
- Read the public web responsePending
- Look for PHP version signalsPending
- Compare evidence with the advisoryPending
- Prepare your findingsPending
No exploit attempts, uploads or private-file probes.
WHAT YOU NEED TO KNOW
A PHP update is the starting point.
Evidence closes the loop.
Who should verify?
If your website or backend runs PHP, ask whoever manages hosting to confirm the installed fixes. Updating WordPress, Drupal, an extension or a WAF does not by itself establish that PHP was patched.
A hidden version is an unknown. An older advertised version may contain vendor-backported fixes.
What does this check establish?
We inspect normal public response headers for PHP signals. We do not attempt exploitation or access protected data. Blocked requests, hidden headers and unsupported connections produce an inconclusive result.
The actual serving runtime and coverage need host evidence.
First upstream releases containing the fixes
Vendor packages and backports need their own confirmation.
PHP 8.28.2.35
PHP 8.38.3.36
PHP 8.48.4.27
PHP 8.58.5.12
COPY THIS TO YOUR HOST
Please confirm which PHP package/build serves our website and whether CVE-2026-109618 and CVE-2026-109619 are fixed. Does that cover every serving worker and origin? Please include the vendor advisory, update date and any compatibility checks still needed.
BOUNDED HELP. CLEAR COSTS.
Start with the evidence.
Agree the work before it starts.
Your host may already include the runtime update. We can help where ownership, compatibility, verification or testing remains unresolved.
VERIFY
Patch & upgrade assessment
£500 fixed after scope confirmation
- One agreed application/environment
- Runtime and vendor evidence review
- Critical checks and upgrade blockers
- Written next-step plan and effort cap
UPDATE & TEST
Managed upgrade package
£1,000–3,000 usually, assessment dependent
- Agreed compatibility fixes
- Deployment and recovery plan
- Selected journey/integration tests
- Documented handover
MAINTAIN
Planned maintenance
From £200per month, subject to assessment
- Defined maintenance window
- Agreed review and work allowance
- Evidence and ownership kept clear
- Extra work quoted separately
Indicative Dadalto prices, not market averages. Larger or legacy estates need a separate quote. Applicable VAT is stated in the written quote. No work is booked by submitting the form. Incident response, penetration testing and 24/7 support are outside these packages.
Questions before you check
Does an inconclusive result mean my site is safe?
No. It means the public response did not provide enough evidence. Ask your host to identify the runtime and confirm its vendor fixes.
Why can an older version already be patched?
Distributions and hosting vendors can backport fixes while retaining the upstream version number. A public version string is not installed-package evidence.
Can you help an agency with client upgrades?
We can discuss a bounded verification, regression-testing or compatibility work package. Actual application fit, access, availability and scope are confirmed before a quote.
What if I think an attack has already happened?
This check cannot establish whether a compromise occurred. Contact your hosting provider or incident-response team; an update does not retrospectively rule out an incident.