Secure the Web A ProjectDiscovery initiative

CriticalCVE-2026-109618CVE-2026-109619

Is your PHP site affected?

Two flaws in PHP itself allow unauthenticated remote code execution. Every app on an affected runtime is exposed. Update PHP now.

Check a URL

Use a site you own or manage. The check sends a normal GET request and reads the PHP version in the response headers. Nothing is exploited.

Fixed releases

Remediation

  1. Upgrade to a fixed release.
  2. Restart PHP-FPM, Apache, LiteSpeed and other PHP workers.
  3. Verify the PHP version the live site runs, not only the CLI.
  4. If you cannot patch now, restrict public access until you can.

Got our email?

Your server is exposing a PHP version affected by both CVEs. Treat it as vulnerable and upgrade now. We read the version your server discloses. We did not attempt to exploit it or access any data. This is not a marketing email. We are not selling anything, and we will never ask for credentials or payment.

Notices come from internet@securetheweb.org.

Apps at risk

WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, WHMCS.

Any of these can be compromised through an affected PHP runtime, whatever app version it runs. Updating the app does not fix it. Update PHP.

Why it is urgent

With mod_php, exploitation may happen before application code runs. Configuration changes do not fully fix it.

About

Exploitation has surged dramatically in the AI era, and we have seen it firsthand. Secure the Web is a fully automated, internet-wide notification system: each time a critical flaw emerges, it finds the exposed systems and notifies their operators as fast as possible, with a pointer to the official fix. PHP2Shell is the first event we are covering, and many more will follow. Upstream maintainers and vendors remain the source of truth.

Built and run by ProjectDiscovery, the team behind Nuclei, the scanner trusted by governments, security teams and researchers worldwide.

Research credit

Security researcher LCFR is credited with the initial discovery and working exploit. The PHP advisories list lcfr-hax, sagitzadik-wiz, tomash-areion and amyb-oai as reporters, and credit arnaud-lb, iluuu1994, bukka and ndossche for the fixes. The work required turning difficult memory-corruption conditions into reliable code execution across different PHP versions and server configurations.

References

Official advisories

Government alerts

Research

Detection

Important: this is a version check only

This tool reads the PHP version a site advertises over HTTP and compares it to the fixed releases. It does not exploit anything, and it cannot see servers that hide their version. A "not vulnerable" or "version not confirmed" result is not a clean bill of health. If you run PHP, confirm the live runtime version yourself: on the server run php -v, check the version your web server actually loads (php-fpm -v, or a phpinfo() page behind authentication), then upgrade to a fixed release and restart your workers. An HTTP header can be hidden or stale, so the server is always the source of truth.