Check your site for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), unsupported PHP versions and known flaws in the apps built on PHP.
A php vulnerability scanner tests a live site for known flaws in PHP itself, in the applications built on it and in nearby files. On 21 October 2026 the PHP project patched PHP2Shell, two critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. ScanTitan checks the exposure a remote scan can see: your PHP version when the server reveals it, known CVEs in your CMS and plugins, and exposed files. This page shows what the scan covers, where it stops and how to check your version today.
PHP2Shell: CVE-2026-109618 and CVE-2026-109619 patched on 21 October 2026
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
PHP 8.2 reaches end of life on 31 December 2026
PHP 8.1 and older get no official fix, only source backports
A PHP vulnerability scanner works in one of two ways. A remote scanner, called DAST (Dynamic Application Security Testing), sends requests to your running site and studies the responses, with no access to your source code. A code scanner, called SAST (Static Application Security Testing), reads the source files for dangerous patterns. Snyk Code and Checkmarx read code, while Intruder, Invicti and ScanTitan test the running site. Choose by the question you need answered. If you ask whether your live site exposes a known flaw today, run a remote scan. If you ask whether your developers wrote an injectable query, read the code. A two-person team usually needs the remote scan first, because it shows what attackers see.
PHP2Shell is the name researchers use for two critical flaws in PHP core, both patched on 21 October 2026.
CVE-2026-109618 is an out-of-memory corruption bug: when PHP runs out of memory it aborts the request, and some code paths leave request memory uninitialized before shutdown code reads it.
CVE-2026-109619 is a stale state bug: request data survives after its memory is freed, so a later request on the same worker reuses it.
NVD scores both 9.8 on CVSS 3.1, and the PHP security team scores both 9.2 on CVSS 4.0. Neither needs a login. An attacker sends ordinary web requests, which is why every CVE here gets treated as urgent.
PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with its PHP module, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on the Apache module. Confirm your version before you change anything.
Read the response headers with curl -I https://yourdomain.com and look for the X-Powered-By line. Many hosts hide it.
Open MultiPHP Manager in cPanel or PHP Settings in Plesk to see the version set for each domain.
Check Tools, Site Health, Info, Server in WordPress.
Run php -v and php-fpm -v on a server you control, and remember the command line can use a different version than the one serving your site.
Ask your host in writing which PHP build serves your site if the first four steps fail.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution's patched package, then restart every PHP worker.
PHP 8.1 and older no longer receive updates from the PHP project. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and LTS vendors backport fixes, so contact your host or vendor.
PHP's own advisory lists configuration workarounds and states that they do not make an installation safe.
Our stance: a plugin or theme update cannot fix either flaw, because the bug sits in the PHP engine.
Our PHP2Shell guide covers fixes by server type and how to check whether someone already used the flaw.
Reports conflict, so read the dates.
Amazon's honeypot network recorded an exploitation attempt on 17 October, four days before disclosure.
watchTowr, Cloudflare and Patchstack report attempts or incidents, while the PHP project and CISA reported no exploitation at publication.
The CISA KEV (Known Exploited Vulnerabilities) catalog, version 2026.10.21, listed neither CVE in the part we read, and FIRST publishes no EPSS (Exploit Prediction Scoring System) score for them yet. The CISA record inside NVD lists exploitation as none.
We re-check all three sources on publishing day.
Scan from outside first, because that is the view attackers have. You need a domain you own or hold written permission to test.
Five checks cover the PHP version, the CMS layer, exposed files, logged-in flows and the order you fix things in.
A PHP engine the PHP project no longer patches is a standing risk, and PHP2Shell shows why: PHP 8.1 and older received no official fix. ScanTitan paid plans include an end of life check that flags unsupported PHP versions, and the free Software End of Life Checker does the same for a version you paste in. The checker runs in your browser and sends nothing anywhere. One limit applies: a remote scan reads the PHP version only when the server reveals it through headers, error pages or framework signals. Confirm the version in your hosting panel, then compare it with the table below. ScanTitan also detects PHP2Shell exposure on the sites it scans, so a vulnerable release shows up as a finding.
Most PHP sites run a CMS, and most breaches start in a plugin, not in the engine. ScanTitan detects component versions and matches them to known advisories and CVE records, using the same engine that runs more than 15,000 CVE-mapped checks across the OWASP Top 10. Use the WordPress, Joomla or Drupal scanner pages when you run one of those systems. Each finding names the component, the detected version, the advisory and the fixed release, so your developer knows what to update without guessing. Fixing these findings means updating the component, not the PHP engine, and a re-scan confirms the result. ScanTitan also fingerprints Laravel and Symfony applications and checks Composer dependencies, so a vulnerable framework or package shows up with its advisory.
Attackers do not need a PHP engine flaw when a backup sits in the web root. ScanTitan checks for readable .env files, backup archives, configuration files and directory listings, along with missing security headers and weak SSL and TLS settings. A PHP file inside a media folder deserves special attention, because it often marks a web shell, a single file that gives an attacker remote control. ScanTitan malware scanning looks for PHP backdoors and obfuscated scripts, and each finding carries HTTP evidence plus a step by step fix. Remove the file, move backups out of the public folder and scan again to confirm the exposure is gone.
Broken access control tops the OWASP Top 10, and it mostly shows up behind a login. ScanTitan runs authenticated DAST scans that sign in and test endpoints, including admin panels and payment flows, for SQL injection, cross-site scripting (XSS), broken access control and known CVEs. Tests that stop at the login page only see your marketing pages. Run the authenticated scan with a test account at the lowest role a real user holds, so results match what a stolen password would reach. When your PHP application exposes an API or a JavaScript front end, use the API and JavaScript scanner pages to see how those layers are tested.
CVSS alone is a poor ordering signal. A CVSS 9.8 flaw with no known exploitation can wait a day behind a CVSS 7.5 flaw that attackers already use. ScanTitan ranks findings with CVSS, EPSS and CISA KEV status, so a two-person team patches the exploited few first. You can test the logic for free: paste CVE IDs into the CVE Priority Checker and read the verdict, Fix now, Fix soon or Fix later, with the reason. The tool treats any KEV listing as Fix now, and it sends CVE IDs only to public data sources.
MITRE and CISA publish the CWE Top 25 (Common Weakness Enumeration) each year, and several PHP weakness classes sit near the top of the 2025 list. The table maps each class to its CWE ID and to our guide, so you can read how the flaw works before a scan finds it. PHP2Shell belongs to CWE-416, use after free, which ranks seventh. Rank shows how often a weakness appears in real vulnerabilities, not how dangerous your own site is. A scan tells you which of these classes your site actually exposes. Deserialization and file inclusion flaws appear mostly in custom code and older plugins, so check those first when your own developer wrote the application.
| PHP vulnerability type | CWE ID and 2025 Top 25 rank | What an attacker gets | Read more |
|---|---|---|---|
| Memory corruption RCE (PHP2Shell) | CWE-416 rank 7 | Code execution on the server | PHP2Shell guide |
| OS command injection | CWE-78 rank 9 | Shell commands on the host | Command injection |
| Code injection | CWE-94 rank 10 | Attacker PHP runs in your app | Obfuscated PHP malware |
| Unrestricted file upload | CWE-434 rank 12 | A web shell in your uploads folder | File upload flaws |
| Deserialization of untrusted data | CWE-502 rank 15 | Object injection and code execution | Covered by authenticated scans |
| SQL injection | CWE-89 rank 2 | Database contents and admin access | Test for SQL injection |
| Cross-site scripting | CWE-79 rank 1 | Script running in your visitors' browsers | What is XSS |
| Path traversal | CWE-22 rank 6 | Files outside the web root | Covered by exposed file checks |
| File inclusion | CWE-98 | Remote or local code loaded by include | Covered by authenticated scans |
The PHP project supports each branch for four years: two of active support and two of security fixes only. The table shows the status on php.net as of 22 October 2026. PHP 8.2 reaches end of life on 31 December 2026, which is 70 days after this update. After that date a new flaw in 8.2 gets no official fix, and your only choices are an upgrade or a paid vendor backport. Move to 8.3 or newer now if you can. Paste your versions into the Software End of Life Checker to see which line of your stack is already unsupported.
| PHP branch | Active support until | Security support until | PHP2Shell fix |
|---|---|---|---|
| 8.5 | 31 Dec 2027 | 31 Dec 2029 | 8.5.12 |
| 8.4 | 31 Dec 2026 | 31 Dec 2028 | 8.4.27 |
| 8.3 | 31 Dec 2025 (ended) | 31 Dec 2027 | 8.3.36 |
| 8.2 | 31 Dec 2024 (ended) | 31 Dec 2026 | 8.2.35 |
| 8.1 | End of life 31 Dec 2025 | None | No official release, source backport only |
| 8.0 | End of life 26 Nov 2023 | None | No official release, source backport only |
| 7.4 | End of life 28 Nov 2022 | None | No official release, source backport only |
| 7.3 and older | End of life 6 Dec 2021 and earlier | None | No fix from the PHP project |
Every finding in the report is built for two readers: the developer who applies the fix and the owner who has to explain the risk. We do not publish invented findings on this page. Each entry holds the same six parts.
A remote scan sees what your server shows the internet, and no more. These limits apply to every external PHP scanner, ours included.
ScanTitan is registered in the Netherlands and operated by an ISO 27001-certified security team, with GDPR-compliant data handling and a data processing agreement on request. Scan findings carry HTTP evidence, so you see exactly what the scanner saw. The free tools work differently from the scanner: the Software End of Life Checker runs in your browser and sends nothing anywhere, and the CVE Priority Checker sends only CVE IDs to public data sources, never to ScanTitan. Create an account, add a domain you own, and review results in one dashboard without installing anything on your server. If your company needs a signed agreement before it scans, ask for the DPA first.
An agency that hosts forty client sites has forty PHP versions to confirm, and PHP2Shell gives each one a deadline. Enterprise platforms price this work for security teams. Small teams need the same answer for less money: which sites run an unsupported or unpatched version, and which findings to fix first. The ScanTitan pricing page lists the Consultant plan per concurrent website and shows white-label reports among the paid features, so you can send clients a report under your own name. Start with the PHP version of every client site, patch the exposed ones this week, and schedule repeat scans for the rest. See the pricing page for plan details.
ScanTitan bills yearly, and the plan you need depends on one question: do you want vulnerability scanning? The Free plan covers malware scanning, basic exposure scanning, basic malware monitoring and basic uptime monitoring, and it does not include vulnerability scanning. Vulnerability scanning, which finds known CVEs in your CMS and plugins, starts on Professional at $119 per year, about $9.92 a month. Business at $155 per year adds 360° scanning, network exposure monitoring, vulnerability and exploit intelligence and API access. Agencies pick Consultant at $486 per year per concurrent website, with unlimited scans and white-labeled PDF reports. Enterprise pricing is custom.
Prices come from the ScanTitan pricing page, checked on 22 October 2026. Check that page for the current plan details before you order.
The log below shows what changed on this page and which facts we checked, so you can judge how fresh it is.
All four competitors are legitimate tools, and most are built for AppSec teams. The table records only what each vendor’s own pages show, reviewed on 22 October 2026. Not documented means we found no description on the page we read, and it is not a claim that the tool cannot do it. Pentest-Tools offers a free PHP2Shell scanner page, so credit where it is due. Our angle differs: we explain the version check, the end of life dates and the fix for a site owner or an agency, and we show how findings are ranked.
| Feature | ScanTitan | Intruder | Invicti | Pentest-Tools | ZeroThreat |
|---|---|---|---|---|---|
| Entry point | Free plan and two free tools | Free trial | Demo only | Free light scan | Free trial |
| PHP2Shell page or tool | PHP2Shell detection, guide and version check on this page | Not on the PHP page | Not on the PHP page | Free PHP2Shell scanner | Not on the PHP page |
| Authenticated scanning | Yes | Yes | Not documented | Yes, behind a 7-day trial | Yes |
| CVSS, EPSS and KEV prioritization | Yes | Not documented | Not documented | Not documented | Not documented |
| End of life PHP version check | Paid plans and a free checker | Not documented | Not documented | Not documented | Not documented |
| Prices shown | On the pricing page | Not on the PHP page | Not on the PHP page | Not documented | Not on the PHP page |
Sources reviewed 22 October 2026: the PHP vulnerability scanner pages of Intruder, Invicti and ZeroThreat, and the free PHP2Shell scanner page of Pentest-Tools. Spotted something out of date? Tell us and we will correct it.
Straight answers about PHP2Shell, PHP versions and what a remote scan can see.
PHP2Shell is the name researchers use for two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, patched on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both let an unauthenticated attacker reach remote code execution through ordinary web requests, and the PHP security team scores both 9.2 on CVSS 4.0. The first corrupts memory after an out-of-memory error, and the second reuses stale request state. PHP 8.1 and older get no official release, only source backports. Our PHP2Shell guide explains how to check your version, apply the fix and look for signs that someone already used it.
If your site runs a PHP version below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on a branch that is still supported, treat it as vulnerable until you update. If you run PHP 8.1 or older, the PHP project issues no official fix, so only a vendor backport or an upgrade protects you. The advisories list affected versions below the fixed releases and do not state a range for older branches, so we make no claim beyond that. Read your version from a header, your hosting panel or php -v, then compare it with the table above. Your host may also patch the package without changing the version string.
Only when the server reveals it. A remote scanner reads the version from response headers, error pages and framework signals, and many hosts hide all three on purpose. When the version stays hidden, a scan cannot tell you whether you run a fixed release, and any tool that claims otherwise is guessing. Confirm the version in your hosting panel or ask your host in writing which PHP build serves your site. ScanTitan paid plans include an end of life check that flags unsupported versions when they are visible, and the free Software End of Life Checker works from a version you paste in.
No. PHP's own advisory lists configuration workarounds and says they do not make an installation safe, and it says updating is the only safe choice. PHP 7.4, 8.0 and 8.1 are end of life, so the project ships no official release for them, only minimal source backports for people who build PHP themselves. Some Linux distributions and long term support vendors backport the fix into their own packages, so ask your vendor for the exact patched package version. If neither option exists for your stack, plan an upgrade to a supported branch and treat the site as exposed until then.
The free plan includes malware scanning, basic exposure scanning, basic malware monitoring and basic uptime monitoring. It does not include vulnerability scanning, which starts on the paid plans, so we do not promise a free PHP vulnerability scan. Two free tools help with PHP2Shell today and need no account: the Software End of Life Checker, which flags unsupported PHP versions from a list you paste in, and the CVE Priority Checker, which ranks up to 25 CVEs by CVSS, EPSS and KEV status. Check the pricing page for the current plan details before you sign up.
No. Both flaws sit in the PHP engine, not in WordPress core, a theme or a plugin, so a plugin update cannot close them. Updating your CMS still matters, because most site compromises start in outdated plugins, but the PHP2Shell fix is a PHP update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your host's patched package. Many managed WordPress hosts patch PHP for you, so ask your host whether it already did and which version your site runs now. Then scan the site to catch the plugin and exposure issues that a patched engine leaves in place.
Attackers did not wait for the patch: Amazon recorded an exploitation attempt four days before disclosure. You do not need a security team to answer the first question. Read your PHP version, compare it with the fixed releases, and scan the site for the weaknesses that sit on top of PHP, such as outdated plugins, exposed backups and missing security headers. ScanTitan ranks every finding by CVSS, EPSS and CISA KEV status and attaches HTTP evidence, so you patch what attackers use first. Start with a scan today, or talk to our team about covering every client site you manage.
OSCP · CISSP · 12 years in web application security · Author profile →
One scanning engine, one report, one set of CVSS, EPSS and CISA KEV priorities. Pick the scanner that matches what you run.
