// VULNERABILITY CHECK
Are you exposed to PHP2Shell?
Enter the domain. We check the PHP version advertised by the server and tell you whether it is vulnerable — without exploitation, using an isolated, disposable container.
DOMAIN OR URL
Resultado PHP2Shell
Não vulnerável
https://pelicanbay.pt
A versão anunciada está acima do limite vulnerável para o seu ramo.
PHP VERSION
8.3.36
DETALHE
PHP 8.3.36
SOURCE
X-Powered-By
IP VERIFICADO
72.60.214.58
REFERÊNCIA
6b04d744-687d-46bf-9537-8233025ff261
DATA (UTC)
Technical response (JSON)
{
"target": "https://pelicanbay.pt",
"patch_status": "ok",
"php_version": "8.3.36",
"source": "X-Powered-By",
"reason": "PHP 8.3.36",
"exit_code": 0,
"scan_id": "cdcb42ff-0192-42ff-b5ad-e1457d01f155",
"timestamp": "2026-10-28T17:35:24Z",
"check_type": "phpcheck",
"submitted_target": "pelicanbay.pt",
"resolved_ip": "72.60.214.58",
"runtime_ms": 1314,
"schema_version": "1"
}
PHP2Shell Result
Vulnerable
https://pelicanbay.pt
Header-based inference — confirm the production version and package revision before treating this as an incident.
PHP VERSION
8.3.36
DETAIL
PHP 8.3.36
SOURCE
X-Powered-By
VERIFIED IP
72.60.214.58
REFERENCE
6b04d744-687d-46bf-9537-8233025ff261
DATE (UTC)
Technical response (JSON)
{
"target": "https://pelicanbay.pt",
"patch_status": "ok",
"php_version": "8.3.36",
"source": "X-Powered-By",
"reason": "PHP 8.3.36",
"exit_code": 0,
"scan_id": "cdcb42ff-0192-42ff-b5ad-e1457d01f155",
"timestamp": "2026-10-28T17:35:24Z",
"check_type": "phpcheck",
"submitted_target": "pelicanbay.pt",
"resolved_ip": "72.60.214.58",
"runtime_ms": 1314,
"schema_version": "1"
}
PHP2Shell Result
Inconclusive
https://pelicanbay.pt
INCONCLUSIVE does not mean fixed — the server does not expose the PHP version in its headers; verify it on the server side.
PHP VERSION
8.3.36
DETAIL
PHP 8.3.36
SOURCE
X-Powered-By
VERIFIED IP
72.60.214.58
REFERENCE
6b04d744-687d-46bf-9537-8233025ff261
DATE (UTC)
Technical response (JSON)
{
"target": "https://pelicanbay.pt",
"patch_status": "ok",
"php_version": "8.3.36",
"source": "X-Powered-By",
"reason": "PHP 8.3.36",
"exit_code": 0,
"scan_id": "cdcb42ff-0192-42ff-b5ad-e1457d01f155",
"timestamp": "2026-10-28T17:35:24Z",
"check_type": "phpcheck",
"submitted_target": "pelicanbay.pt",
"resolved_ip": "72.60.214.58",
"runtime_ms": 1314,
"schema_version": "1"
}
// VULNERABILITY CHECK
PHP2Shell: unauthenticated remote code execution
Two critical vulnerabilities in the PHP engine itself allow code to be executed on a web server with a single HTTP request, before the application runs. The vulnerabilities do not depend on the website’s code or authentication — unauthenticated remote code execution has been demonstrated against WordPress, Drupal, and Joomla.
9.2
CVSS v4.0 · Critical
1
HTTP request, no authentication required
5.4-8.5
Affected PHP branches
17 out
First observed exploitation attempt, before disclosure
CV – 2026-109618
Out-of-bounds memory corruption
When a request reaches memory_limit, PHP aborts in the middle of an operation and leaves request data partially initialized. The cleanup code subsequently treats this data as valid. A forged multipart upload, within normal limits, is sufficient to trigger it.
CV – 2026-109619
Stale state across requests
A fatal error leaves global state pointing to memory that has already been freed; the next request handled by the same worker uses it (use-after-free). Confirmed attack paths include session upload progress. — enabled by default, even when the application does not use sessions — and warnings involving directory/request-level settings (.htaccess, PHP_VALUE). In addition to code execution, this can disclose worker memory, regardless of the application.
Who Is Exposed
| Branch | Vulnerable up to | Fixed in |
|---|---|---|
| 8.5 | 8.5.11 |
8.5.12 |
| 8.4 | 8.4.26 |
8.4.27 |
| 8.3 | 8.3.35 |
8.3.36 |
| 8.2 | 8.2.34 |
8.2.35 |
| 8.1 · 8.0 · 7.4 | All versions | End of life — no official release; distribution/LTS packages or code backports |
| 7.3 and earlier (≥ 5.4) | All versions | No fix — migrate to a supported branch |
// HOW TO FIX
Remediation Steps
Only a PHP update fixes the issue. The mitigations below buy time, but they do not eliminate all variants.
01
Identify Where PHP Runs — and How
Inventory the servers running PHP and determine their execution mode. Prioritize Apache with mod_php. and anything exposed to the internet.
apachectl -M 2>/dev/null | grep -E ‘mpm_|php’ # mpm_prefork + php_module = mod_php
php -v; php-fpm -v # CLI and FPM versions may differ
02
Update PHP
Upstream: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35. On Linux, prefer your distribution’s packages, which already include the fix (often via a backport).
# Debian / Ubuntu
sudo apt update && sudo apt upgrade
# RHEL / AlmaLinux / Rocky
sudo dnf upgrade ‘php*’
# Containers: rebuild from the patched base image and redeploy
docker compose build –pull && docker compose up -d
03
Restart the workers
The processes already running continue with the vulnerable code until they are restarted — including long-running PHP workers (queues, FrankenPHP in worker mode, Swoole, RoadRunner).
sudo systemctl restart php-fpm # or php8.3-fpm (Debian/Ubuntu)
sudo systemctl restart httpd # or apache2, if using mod_php
After fixing:the fix introduces a hard memory limit — when reached, the process terminates without running the shutdown handlers. Review the memory_limit against post_max_size and the request size, and undo any temporary memory_limit = -1.
04
Confirm the package version, not just the banner
Distributions apply the fix without changing the advertised version — php -v and the header continue to show the old number. A VULNERABLE result here may be a false positive: confirm via the package and your distribution’s security advisory.
rpm -q php-common # RHEL / AlmaLinux / Rocky
dpkg -l ‘php*’ | grep ^ii # Debian / Ubuntu
05
If you can’t update yet: mitigate
Temporary and partial measures: each one covers only some exploitation paths. Apply in php.ini , /etc/php.d/ , or the PHP-FPM pool — ini_set() and .user.ini arrive too late — and restart the workers.
; php.ini / /etc/php.d/
session.upload_progress.enabled = 0 ; closes confirmed session paths (CVE-2026-109619)
post_max_size = 8M ; 32M if you need uploads; keep upload_max_filesize lower
max_input_nesting_level = 32 ; example — default is 64; lower if the application allows
display_errors = 0 ; don’t return errors to the client
fatal_error_backtraces = 0 ; where supported
; PHP-FPM pool
php_admin_value[memory_limit] = -1 ; only with container/cgroup v2 limit (memory.max)
pm.max_requests = 100 ; example — recycles workers; costs performance
Do not use RLIMIT_AS or RLIMIT_DATA as a substitute for the memory limit — they can trigger the very flaw.
○ memory_limit = -1 blocks paths that depend on the memory limit, but exhaustion passes to the operating system: constrain it with memory.max (cgroup v2) or the container memory limit.
○ Limit request size at the proxy/web server and enable WAF/CDN rules for PHP2Shell, if your provider offers them — coverage varies and does not replace the fix.
○ SELinux/AppArmor can restrict what the worker is able to execute, but they don’t prevent all exploitation or memory disclosure.
○ Replace mod_php with PHP-FPM using the event MPM.
○ Fix fatal errors and timeouts that an attacker could trigger (uploads, imports, callbacks).
○ If the system cannot be patched immediately, the NCSC (United Kingdom) recommends taking it offline.
06
End-of-life versions
PHP 8.1 and earlier no longer receive official releases. Use the patched packages from your distribution or from an LTS vendor, or the minimum backports published for 7.4/8.0/8.1 — and plan a migration to 8.2+. Below 7.4, migrating is the only option.
07
Look for signs of compromise
There were exploitation attempts before the disclosure. Review logs since mid-October: fatal memory errors ( Allowed memory size … exhausted) and unexpectedly terminated workers, anomalous multipart requests followed by repeated memory errors or HTTP 500s, unusually large or malformed PHPSESSID response cookies, new files in the webroot, and unexpected PHP child processes.
None of these signs confirm exploitation on their own, and the absence of signs does not prove the system was not affected — the flaw is below the application layer and some attacks only leak memory. Patch anyway.
08
Reduce exposure
After patching, stop advertising versions. It doesn’t fix anything, but it makes reconnaissance harder — and this checker will start showing INCONCLUSIVE.
expose_php = Off ; php.ini — remove X-Powered-By
ServerTokens Prod # Apache
server_tokens off; # nginx
SOURCES · UPDATED ON 22 OCT 2026
php2shell.com — remediation & mitigations PHP — GHSA-w8hw-w9fx-j79w (CVE-2026-109618) PHP — GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) AlmaLinux — php2shell: patched PHP packages Help Net Security — PHP2Shell patched The Hacker News — Emergency patches for PHP2Shell
DISCLAIMER
This checker is intended exclusively for authorized persons, for their own domains or those under their responsibility, or with the express authorization of the respective owner. Usage is the sole responsibility of the person performing it; SIBS Cyberwatch disclaims any responsibility for improper or unauthorized use. Each verification is logged (date, source IP, domain, and result) for audit and security purposes. The result is an inference based on HTTP headers and does not replace a technical assessment.