Is your PHP server
exposed to PHP2Shell?
Check your PHP version, find the right security update, and get help patching the runtime behind your website.
Your PHP setup
PHP RUNTIME GUIDANCE FOR THE TOOLS YOU USE
PHP
WordPress
Laravel
Docker
AWS
Cloudflare
Nginx
UbuntuPHP2SHELL EXPLAINED
Understand the issue.
Update your PHP runtime.
PHP2Shell affects the engine beneath your application.
Start with what is running, then choose the right fix.
A PHP issue.
An application-wide concern.
Learn how the vulnerabilities work, which runtime configurations need attention, and why your framework is only part of the picture.
Understand PHP2Shell 02 / ASSESSYour configuration.
A more useful answer.
Answer a few questions about your PHP version, hosting and patch status. Get guidance that makes room for vendor backports and unknowns.
Check your PHP setup 03 / REMEDIATEPatch the runtime.
Verify what is serving traffic.
Use a guide for your environment. Prepare the change, replace affected workers, and confirm the fixed build is actually running.
Find your fix guideCHECK YOUR CONFIGURATION
Find out what your
PHP setup needs.
Answer a few questions about your version, hosting and patch status. Get an assessment with the checks and updates relevant to your setup.
- Understand upstream releases and vendor fixes
- Account for your serving runtime and hosting
- Leave with relevant, actionable guidance
What powers your website?
A little about your application helps us find the right guide.
THE PATCH IS THE PRIORITY
Know your version.
Verify your patch.
These are the first fixed upstream releases for the two CVEs. Your distribution may ship a backported fix with a different version number.
See version & vendor guidanceSnapshot reviewed 22 Oct 2026. Always check current advisories.
YOUR STACK. YOUR FIX.
Guidance for the way you deploy.
WordPress
Host-level patching
Laravel
Runtime & worker checks
Docker
Images, rebuilds & redeploys
AWS
Instances & cloud workloads
Ubuntu
Packages & backported fixes
Debian
Security updates & services
Nginx
FastCGI & FPM routing
Apache
mod_php & FPM handlers
PHP-FPM
Pools & persistent workers
cPanel
Per-domain PHP settings
Plesk
PHP handlers & service updates
Cloudflare
WAF protection & its limits
Shared hosting
Provider checks & updates
EXPOSURE IS NOT PROOF OF INTRUSION
Concerned about
a possible compromise?
A vulnerable version does not prove a hack. A patched version does not prove a clean server. Learn what evidence to preserve and which signals deserve investigation.
Read the investigation guideWHEN YOU NEED A HAND
Need help updating PHP
or investigating exposure?
Get help assessing your setup, upgrading PHP, or investigating a period of exposure. Scope and availability are agreed before work begins.
Request emergency helpIs my WordPress website affected?
The PHP runtime beneath WordPress needs review. Updating WordPress core or a plugin does not update the server’s PHP installation. Ask your host which PHP package is serving your domain and whether it contains fixes for both CVEs.
Does Cloudflare protect me from PHP2Shell?
Cloudflare has published WAF protections for attack patterns it has identified. Keep those protections enabled and review origin access. A WAF does not install the PHP patch, cover every possible vector, or establish that your server has not been compromised.
Which PHP versions contain the upstream fixes?
The first fixed upstream releases published on 21 October 2026 are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution vendors may provide backported fixes under older upstream version numbers. Match the complete package revision to the vendor notice.
Can this checker tell whether my server was hacked?
No. It interprets information you provide about your setup. It does not contact your server, scan your website, or detect compromise. Investigating a possible incident requires evidence from logs, files, processes and other sources.
I have upgraded PHP. Am I finished?
Confirm every serving instance and worker is using the fixed build, including containers, background services and alternate pools. Test your application and review the period of exposure. Updating PHP does not remove persistence or undo credential theft.
VERIFY THE INFORMATION
Built on published sources.
Read the advisories. Check the evidence.
Research credit belongs to the original authors.
The PHP Foundation describes the earlier Quarkslab audit and subsequent reports from Calif, OpenAI and Wiz. These links identify their publications and contributions; they do not imply endorsement of this independent website.
