CTRL-A Technical Services
CVE-2026-109618CVE-2026-109619 Critical · CVSS 9.2Disclosed Oct 21, 2026

CTRL-A Web Exposure Check

php2shell (PHP remote code execution). Two flaws in PHP itself let an attacker take over a web server with one request, before any website code or login runs. Find out in seconds whether your site is advertising an affected version.

At riskPHP 8.1 and older; unpatched 8.2 to 8.5
Safe from8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
How we lookOne ordinary page visit. Nothing intrusive.

CTRL-A Web Exposure Check

Is your site exposed to php2shell?

We read what your homepage already tells every visitor about the software behind it, then compare that to the fix. Your results show up right here, and we email you a copy.

We can only see what your server shows the public. A clean result is a good sign, not proof.

Website
Reported PHP
Fixed release
Checked

Evidence

What to do

  1. Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. If PHP comes from your Linux distribution or hosting provider, install their patched package instead.
  2. Restart PHP-FPM, Apache or your PHP service after updating so the old workers stop running.
  3. If the server runs PHP 8.1 or older, plan an upgrade to a supported branch. Ask your vendor whether a backported fix is available in the meantime.
  4. If you cannot patch today, take the site offline or put it behind a web application firewall. Cloudflare has published managed rules for known exploit attempts, but a firewall is not a substitute for patching.
  5. Hide the PHP version from visitors by setting expose_php = Off in php.ini. This does not fix anything, but it stops scanners from reading your version.
  6. Check the server for signs of compromise: unexpected shell processes started by PHP, new files in web folders, and memory errors in PHP logs around the disclosure date.

References

This report is based only on what the homepage publicly reports. Servers behind load balancers, other subdomains, and vendor-patched builds may differ. Confirm on the server before closing the issue.

Want a second set of eyes? CTRL-A can confirm the server's real PHP build, patch it, and check for signs of compromise.

Book a call