Is your website vulnerable?
Scan it free right now.

What are these vulnerabilities?

On October 21, 2026, the PHP project disclosed two critical vulnerabilities collectively known as "php2shell":

• CVE-2026-109618 — RCE via out-of-memory corruption. CVSS 9.2. An unauthenticated request can trigger remote code execution before any application code runs.
• CVE-2026-109619 — RCE via stale global state. CVSS 9.2. A fatal error leaves freed memory that the next request uses — classic use-after-free.

Both affect every PHP installation serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. PoC exploits are circulating.

What this scanner checks

• Whether PHP is detected on your server
• Your PHP version (if exposed in headers)
• Whether your version is vulnerable to CVE-2026-109618 and CVE-2026-109619
• Common CMS detection (WordPress, Drupal, Joomla)
• SSL/HTTPS status

Note: This scanner checks your publicly visible HTTP headers. If your server hides the PHP version (good practice), the scanner will detect PHP but may not be able to confirm the exact version. For a full assessment, contact us.