TrendAI™

See the Risk.
Own the Response.

Identify potential PHP2Shell exposure and take the next step with guidance from TrendAI™ security experts.

Check your websiteSee affected versionsTrendAI Vision One™
  • 2critical CVEs
  • 9.2/10severity score
  • 0exploit payloads sent

Could Your Website Be Exposed?

Enter your website URL to check for potential signs of PHP2Shell exposure.

Public website only

Checks the URL you provide and its redirects.

Evidence, not exploits

Reads HTTP headers and a bounded HTML sample.

Verify your patch status

Signals do not confirm vulnerability or safety.

What is PHP2Shell? Affected PHP versions and fix

PHP2Shell refers to two critical PHP remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, covered by the PHP security advisory of 21 October 2026. Any server running an affected PHP version, including web applications, CMS sites and shared hosting, may be exposed. Update PHP to a fixed release or apply your vendor's patch, then use the PHP2Shell exposure checker to see what your site's public HTTP responses reveal.

Read the TrendAI™ customer advisory for PHP2Shell and our blog, Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now, for official guidance.

Affected and fixed PHP versions for CVE-2026-109618 and CVE-2026-109619
PHP branchAffected versionsFixed in
5.4 to 8.1 End-of-lifeAll releasesUpgrade to a supported branch, or confirm vendor backports
8.28.2.0 to 8.2.348.2.35
8.38.3.0 to 8.3.358.3.36
8.48.4.0 to 8.4.268.4.27
8.58.5.0 to 8.5.118.5.12

Linux distributions often backport security fixes without changing the PHP version string, so confirm patch status with your vendor. A version signal alone does not prove that a site is, or is not, exploitable.

Advisory details

Two critical flaws behind PHP2Shell

CVE-2026-109618Severity: Critical (9.2/10)

RCE via OOM corruption

RCE via OOM corruption, CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state. The failed allocation does not need to be related to the invalid memory. The request shutdown procedure may then read or branch on it. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVE-2026-109619Severity: Critical (9.2/10)

RCE via stale global state

RCE via stale global state, CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the next request. They inadvertently access stale state not reset by the previous request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE).

Understand Your Risk
Stay Protected

Assess Your Risk

Identify potential PHP2Shell exposure and better understand your risk.

Know Your Next Steps

Connect with TrendAI™ security experts to understand your risk and explore next steps.

Talk to a TrendAI™ expertStart Free Trial
KNOW BEFORE YOU SCAN

Local Scan Terms & Conditions

Authorized Use

Only run this scanning tool on systems you own or are explicitly authorized to assess. By proceeding, you confirm that you have the necessary permissions to perform the scan and share its results with TrendAI™.

Data Collection & Use

The scanning tool collects the following information from the scanned system:

This information, together with your submitted email address, will be transmitted to and stored by the TrendAI™ portal for the purpose of providing and displaying your scan report.

How the Scan Works

The scanning tool runs locally within your environment. The TrendAI™ portal receives and displays the scan results but does not remotely execute commands on your system.

Scan Limitations

The scan identifies potential indicators of PHP2Shell exposure but does not guarantee detection of all vulnerabilities or security issues. Findings should not be considered definitive proof that a system is vulnerable, exploitable, or secure. Independent verification of your system's configuration, installed software versions, and security patch status is recommended.

Your Acknowledgment

By proceeding, you confirm that you are authorized to scan the target system and consent to the collection, transmission, and processing of the information described above.
KNOW BEFORE YOU SCAN

Terms of Service

Service Scope & Nature. This service operates strictly as a passive data auditor. This service performs standard HTTP GET requests against the submitted publicly accessible website. It validates each redirect destination and follows a defined maximum number of redirects. The scan inspects response headers and does not crawl websites, deliver exploit payloads, or verify exploitability. It does not crawl deeper pages, inject exploit payloads, verify exploitability, or disrupt server operations.

Results and Limitations. Findings are informational and should not be considered definitive evidence of vulnerability, exploitability, or security. Detected PHP version indicators do not establish exploitability, and the absence of such indicators does not establish that a website is secure. Users should independently verify their installed PHP version, configuration, and vendor patch status before determining appropriate actions.

No Warranties. The service and all results are provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement. We do not warrant that the service will be uninterrupted or error-free, that results will be accurate or complete, or that the version information and advisory data used in the assessment are current. You are solely responsible for verifying findings and for any decisions made based on them.

Limitation of Liability. To the maximum extent permitted by law, Trend Micro will not be liable for any indirect, incidental, or consequential damages, or for any lost profits, revenue, data, or business opportunities, arising from your use of or reliance on the service or its results. Nothing in these Terms of Service limits any liability that cannot be limited under applicable law.

Advisory Reference. Our assessment follows the PHP security advisory issued on October 21, 2026. However, differences in distribution-specific patches and the accuracy of HTTP headers may affect the results. Additional verification is required.