Skip to content

PHP version banner needs a PHP2Shell patch check

Compares PHP versions advertised in sampled same-origin Server and X-Powered-By response headers with the fixed upstream releases for CVE-2026-109618 and CVE-2026-109619. This is a passive version check, not an exploit test. Hidden or ambiguous versions remain unverified.

Why this matters

Unpatched PHP web runtimes may allow unauthenticated remote code execution. A banner below the fixed release warrants prompt verification, but may be stale or backed by a vendor security patch. A passing banner comparison does not prove runtime safety or absence of compromise.

How to fix it

Ask your host to verify the running PHP build and vendor advisory. Update to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a later fixed supported release, or confirm vendor backports for both CVEs. Restart every PHP worker and rebuild affected containers. Hiding the header does not patch PHP. Investigate suspected compromise with host telemetry.

Check this PHP2Shell signal on your website.

Enter a website in the dedicated checker to run only the PHP2Shell version assessment. No Quick Scan, Full Audit or audit credits are involved. Hidden versions remain inconclusive.

Run the PHP2Shell check