Is your PHP fixed?
Check whether your PHP build includes the October fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Three steps, about 30 seconds.
It runs entirely in your browser. Nothing you choose or paste leaves this page.
Platform data last checked , from each platform’s own advisories and release notes.
The checker
The checker needs JavaScript. It runs only in your browser and sends nothing. Without it, the steps under Check it by hand show how to tell from the server itself.
- Where it runsWhere
- Version
- Answer
Next steps
CVE-2026-115560: no fix from PHP yet
On 23 October, PHP disclosed a related flaw, CVE-2026-115560, that the 21 October releases do not fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. PHP says exploitation needs an unusual configuration and is unlikely.
session.upload_progress.enabled=0Read-only commands to confirm it on the server
Sources
Want it checked and in writing?
Patch Verification & Compromise Review. Am I patched, and was I already hit? Answered per CVE, in writing you can forward. $590 per server, includes 1 site.
How it decides
Three possible answers, and only from what each platform has published.
-
This build includes the fixes
Your installed package build (from
dpkg-queryorrpm -q), or for Docker the image’s PHP version, is at or above a fixed build that two different primary documents name for your platform and branch. -
Older than the fixed build
Your package build is below that fixed build. The answer names the build to update to.
-
Can’t tell from version
Everything else: a fix only one source names, a backport that keeps the old number, a host that patched on its side, or a version from
php -valone. The answer shows what the platform lists and how to check on the server.
Check it by hand
A version number can't prove whether PHP is patched. Many hosts and Linux distributions ship the fix as a backport that keeps the old version number. The command-line php -v may not even be the PHP that serves your website. And a patched package isn't actually running until PHP's worker processes are restarted.
PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For CVE-2026-115560, set session.upload_progress.enabled=0 and restart PHP.
Questions
Does anything I type leave my device?
No. The checker runs in your browser. Its data is part of this page, so it makes no requests while you use it, and nothing you choose or paste is sent anywhere. A link you share carries only the platform and the version, after the # sign, which browsers don’t send to servers.
Why can’t a version number always tell?
A version number can't prove whether PHP is patched. Many hosts and Linux distributions ship the fix as a backport that keeps the old version number. The command-line php -v may not even be the PHP that serves your website. And a patched package isn't actually running until PHP's worker processes are restarted.
Where do the answers come from?
From what each platform has published: security trackers, advisories, release notes and status pages. The checker says a build includes the fixes only when two different primary documents name that exact fixed build; everything else is “Can’t tell from version”. Every answer links its sources and the date we checked them. The data covers 29 platforms, last checked October 26, 2026.
What about CVE-2026-115560?
On 23 October, PHP disclosed a related flaw, CVE-2026-115560, that the 21 October releases do not fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. PHP says exploitation needs an unusual configuration and is unlikely.
If my build includes the fixes, is my website fixed?
Not necessarily. A platform has published a fixed build; that doesn’t mean your server runs it. That takes the update, a restart, and the CVE-2026-115560 setting. And the command-line php -v may not be the PHP that serves your website.