MAURITIUS TELECOM · SECURITY

PHP2Shell

PHP security advisory

Understand the attack.
Protect what runs your website.

Two flaws in PHP’s engine can let an attacker run code on an affected server. Updating your website’s plugins alone won’t fix the underlying PHP runtime.

Explore the solutions Check your PHP
Runtime-level riskOfficial fixes available

What is the PHP attack?

It starts beneath your website, in the software that runs it.

PHP processes requests behind websites such as WordPress, Drupal and Joomla. PHP2Shell is the name for two vulnerabilities in that engine: CVE-2026-109618 and CVE-2026-109619.

These memory-handling flaws can lead to remote code execution. In plain language, a successful attacker could make the server run their code, with the permissions of the PHP process.

Read the technical explanation

What this means for you

A website can look normal while its PHP version needs an update. The fix belongs at the hosting or server level.

On managed hosting? Ask your provider to confirm that the PHP runtime serving your site has received the security fix.

Fix the cause. Then verify.

Start with the runtime update, and confirm it reaches every part of your website.

  1. 1

    Update PHP to a patched release

    Back up your site and test compatibility. Install the security release for your supported PHP branch, or a later release. For older branches, plan a supported upgrade with your host.

    PHP 8.2 8.2.35+PHP 8.3 8.3.36+PHP 8.4 8.4.27+PHP 8.5 8.5.12+
    Official PHP security releases
  2. 2

    Restart services and verify the running version

    Restart or redeploy the affected PHP services after updating. Check PHP-FPM, Apache, containers and background workers; the command-line version can differ from the one serving your site.

    php -v

    Run on your own server. For distribution backports, confirm the installed package with your vendor’s advisory.

  3. 3

    Check again and keep monitoring

    Use the scanner below to compare the version, then review server logs for unusual activity. WAF protections may help while you patch, but they don’t replace the runtime update. If compromise is suspected, investigate it as well as patching.

    Continue to the scanner
  4. 4

    Put the server down temporarily

    If you cannot apply the fix immediately, take the affected website or PHP service offline while you arrange the update. Coordinate the downtime with your hosting provider or server administrator. Restore access after patching and verifying the running PHP version.

Check your PHP exposure

Enter a website you manage, a PHP version, or the output of php -v.

Read the Terms of Service

Version checks run locally in your browser. Website checks open the full assessment, inspect public headers for PHP version information. Only scan sites you own or are authorized to test.

Please note: your IP address will be recorded when you run this check.

Open full assessment

Articles & reference

Read original research, official release notes and trusted PHP security guidance.

All articles
PHP supported versions PHP security manual OpenAI PHP2Shell checker