The critical, unauthenticated remote code execution flaw in PHP. Here's how PentX finds it, and the free way to know if you're exposed.
PHP2Shell is a critical weakness in the PHP engine itself. A single crafted request to an affected PHP application can be escalated into arbitrary code execution on the server: no login, no credentials, no user interaction. If you run PHP, it is the kind of flaw that turns a web page into a shell.
No account and no privileged access required. Anyone who can reach the application can attempt it.
Successful exploitation runs attacker-controlled code with the privileges of the web process.
PHP powers a large share of the web. The affected version range spans years of releases, including every end-of-life branch.
Finding PHP2Shell exposure is the hard part: the tell is subtle and most scanners miss it. PentX looks for it the way a real attacker would, during live, autonomous testing, so you learn you're exposed before someone else does.
PentX reads the PHP version from response headers, cookies and page content, the same signals an attacker reads first.
That version is checked against the PHP2Shell fix table, including every end-of-life branch that will never get a patch.
Anything that cannot be confirmed patched is surfaced rather than hidden, so a stripped or unknown version never reads as safe.
PentX re-tests your surface so a regression or a forgotten host does not quietly reintroduce the exposure.
If you can't prove you're on a patched release, assume you're exposed. End-of-life branches will never get a fix.
Run the free PentX PHP2Shell checker. It sends read-only requests, reads your PHP version, and tells you in seconds whether you're exposed: no payloads, no account, no cost.
Read-only · No sign-up · Results in under a minute
Check the PHP version on every host and container. The free checker does this for your public endpoints in seconds.
Move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later). On an EOL branch, upgrade to a supported one. There is no back-port.
Re-check after you patch, and keep watching. PentX re-tests your surface so a regression or a forgotten host doesn't slip back in.
PHP2Shell is a critical, unauthenticated remote code execution vulnerability in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. It lets an attacker turn an ordinary request to a PHP application into arbitrary code execution on the server, with no credentials required.
Every PHP branch below 8.2 is end of life and has no fix, so it's treated as vulnerable. On supported branches, the fixes are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; anything below those is vulnerable.
Yes. PHP 5.x and 7.x are end of life and receive no security patches, including for PHP2Shell. If you're still running them, treat them as vulnerable and upgrade to a supported, patched release.
Use the free PentX PHP2Shell checker. It sends only read-only requests, reads your PHP version, and tells you in seconds whether you're exposed. No account and no payload required.
Upgrade PHP to a patched release for your branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. On an end-of-life branch (8.1 or below), upgrade to a supported, patched version.