PHP2Shell Exposure CheckerSee the Risk.
Own the Response.

Identify potential PHP2Shell exposure and take the next step with guidance from TrendAI™ security experts.

Could Your Website Be Exposed?

Enter your website URL to check for potential signs of PHP2Shell exposure.

Public website only

Checks the URL you provide and its redirects.

Evidence, not exploits

Reads HTTP headers and a bounded HTML sample.

Verify your patch status

Signals do not confirm vulnerability or safety.

What is PHP2Shell? Affected PHP versions and fix

PHP2Shell refers to two critical PHP remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, covered by the PHP security advisory of 21 October 2026. Any server running an affected PHP version, including web applications, CMS sites and shared hosting, may be exposed. Update PHP to a fixed release or apply your vendor's patch, then use the PHP2Shell exposure checker to see what your site's public HTTP responses reveal.

Read the TrendAI customer advisory for PHP2Shell and our blog, Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now, for official guidance.

Affected and fixed PHP versions for CVE-2026-109618 and CVE-2026-109619
PHP branchAffected versionsFixed in
5.4 to 8.1 (end-of-life)All releasesUpgrade to a supported branch, or confirm vendor backports
8.28.2.0 to 8.2.348.2.35
8.38.3.0 to 8.3.358.3.36
8.48.4.0 to 8.4.268.4.27
8.58.5.0 to 8.5.118.5.12

Linux distributions often backport security fixes without changing the PHP version string, so confirm patch status with your vendor. A version signal alone does not prove that a site is, or is not, exploitable.

CVE-2026-109618Severity: Critical (9.2/10)

RCE via OOM corruption

RCE via OOM corruption, CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state. The failed allocation does not need to be related to the invalid memory. The request shutdown procedure may then read or branch on it. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVE-2026-109619Severity: Critical (9.2/10)

RCE via stale global state

RCE via stale global state, CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the next request. They inadvertently access stale state not reset by the previous request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE).

Understand Your Risk
Stay Protected

Assess Your Risk

Identify potential PHP2Shell exposure and better understand your risk.

Know Your Next Steps

Connect with TrendAI™ security experts to understand your risk and explore next steps.

KNOW BEFORE YOU SCAN

Scan Terms & Limitations

Authorized use only. By submitting a website, you confirm that you own it or have authorization to test it.

Scope of scanning. This service performs standard HTTP GET requests against the submitted publicly accessible website. It validates each redirect destination and follows a defined maximum numbers of redirects. The scan inspects response headers and does not crawl websites, deliver exploit payloads, or verify exploitability.

Results and limitations. Findings are informational and should not be considered definitive evidence of vulnerability, exploitability, or security. Detected PHP version indicators do not establish exploitability, and the absence of such indicators does not establish that a website is secure. Users should independently verify their installed PHP version, configuration, and vendor patch status before determining appropriate actions.

Advisory reference. Our assessment follows the PHP security advisory issued on October 21, 2026. However, differences in distribution-specific patches and the accuracy of HTTP headers may affect the results. Additional verification is required.