ExaPHP2Shell

A defensive, non-exploit exposure check for the two critical PHP core RCEs nicknamed PHP2Shell. It reads a target's PHP version from response banners and compares it against the fixed releases. No memory corruption is attempted and no payload is sent.

CVE-2026-109618 · OOM corruption CVE-2026-109619 · stale global state CVSS 9.2 · patched 21 Oct 2026

1 Scan a site

Target URL

Backend: checking…

Backend settings

Scanner API endpoint (your Lambda Function URL / API Gateway)

With a backend set, Scan reads the live banner and renders a verdict automatically. Without one, Scan tries a best-effort browser request and otherwise falls back to the assisted command below. The endpoint is stored only in this browser.

Fixed versions

Branch	Vulnerable	Fixed	Status
PHP 8.5	< 8.5.12	8.5.12	supported
PHP 8.4	< 8.4.27	8.4.27	supported
PHP 8.3	< 8.3.36	8.3.36	supported
PHP 8.2	< 8.2.35	8.2.35	EOL 31 Dec 2026
PHP 8.1 / 8.0 / 7.4	all	backport	end of life
PHP 7.x / 5.x	from 5.4	none	no upstream fix

Confirm by package changelog, not the version string: distros backport without bumping it (rpm -q --changelog php-fpm | grep CVE-2026-10961).

If vulnerable

Patch to the fixed release for your branch, then restart workers: a patched file on disk does not protect a running worker.
Interim only: block multipart/form-data on routes that don't need uploads, set session.upload_progress.enabled=0, keep session.use_strict_mode=1, and on PHP 8.5 set fatal_error_backtraces=0. Config alone is not a full fix.
EOL branches get no upstream fix: take a vendor/source backport or upgrade; isolate un-patchable hosts.