Loading tool...
High-precision security diagnostic for the trending PHP2Shell remote code execution (RCE) vulnerability. Detect real PHP runtimes with zero false positives, verify emergency patch compliance, inspect exposed FastCGI ports, and generate executive reports instantly — free, no login required.
PHP2Shell is the threat intelligence moniker assigned to two critical vulnerabilities disclosed directly in the core PHP runtime — CVE-2026-109618 and CVE-2026-109619. Unlike older attacks like CVE-2024-4577 (which specifically targeted Windows CGI argument parsing), PHP2Shell affects all operating systems (Linux, FreeBSD, Windows) and virtually all server deployment architectures including Apache mod_php, PHP-FPM, FrankenPHP, and LiteSpeed.
The root cause stems from core memory management and abnormal error handling during request lifecycles. Attackers exploit these flaws by weaponizing multipart form data and corrupted memory allocations to transform unhandled fatal exceptions into arbitrary remote code execution (RCE) — enabling complete server takeover without requiring application credentials.
PHP relies on longjmp() to immediately abort request execution during memory exhaustion faults. When triggered during multipart file uploads or complex boundary parsing, the request is interrupted while internal structs are only partially populated. During request teardown, PHP attempts to free this uninitialized memory, leading to deterministic heap corruption and arbitrary code execution.
In persistent multi-request worker processes (such as PHP-FPM and Apache mod_php), PHP engine components retain global pointers into request-allocated memory. When abnormal errors abort a request without thoroughly cleaning global state, the subsequent request served by the exact same worker thread inherits poisoned pointers, causing use-after-free and cross-request memory takeover.
| Server SAPI | Exploit Exposure Level | Pre-Auth Execution | Threat Mechanics & Impact |
|---|---|---|---|
| Apache mod_php | CRITICAL (HIGHEST) | Yes (Immediate) | Payloads are parsed before application routing starts. Application-level WAFs (like Wordfence) are completely bypassed because memory corruption triggers inside Apache worker memory prior to PHP script execution. |
| PHP-FPM (Nginx / Caddy) | CRITICAL | Yes | Standard pool configuration reuses worker processes across thousands of requests (pm.max_requests). Corrupted heap buffers persist across user sessions. |
| FrankenPHP & LiteSpeed | HIGH | Yes | Early-state worker pooling exhibits identical memory state inheritance unless aggressive worker cycling or process isolation is configured. |
| CLI / One-Off Cron | LOW | No | Process terminates immediately after task execution; no long-lived worker pool exists to carry forward polluted memory states. |
If upgrading your core PHP binary immediately is impossible due to production maintenance windows, implement these defensive controls to reduce attack surface and neuter known exploit payloads:
Disable PHP's internal upload tracking buffer in php.ini to block standard exploit triggers:
session.upload_progress.enabled = Off
Force PHP-FPM to kill and respawn workers after a low request threshold to destroy poisoned memory pools:
pm.max_requests = 100
Deploy WAF rules to inspect HTTP request headers and drop abnormal multipart nesting depth and excessive header byte sizes.
Rule: PHP2Shell-OOM-Guard
Our scanner uses a high-precision runtime fingerprint that goes beyond simple header checks. We verify actual PHP execution signals — not textual mentions of "PHP" or "WordPress" in content (which causes false positives in naive tools like Imperva's scanner).
CVE-2026-109618 targets memory management during abnormal termination (longjmp() during multipart upload OOM), causing heap memory corruption. CVE-2026-109619 is a stale global state flaw where persistent worker processes (like PHP-FPM or mod_php) retain pointers to request memory that was already freed, allowing subsequent requests to access and execute corrupted memory.
Yes. If your WordPress hosting runs an unpatched PHP version (8.2.34 and below, 8.3.35 and below, etc.), you are at risk. Because this flaw is inside the core PHP runtime binary, WordPress plugins and themes cannot prevent it without binary patching or perimeter WAF mitigations.
With Apache mod_php, incoming HTTP request headers and multipart body payloads are parsed inside the web server worker process before any PHP application code (like WordPress index.php) executes. This allows remote attackers to trigger the memory corruption before application-level security firewalls can inspect or block the request.
No. PHP2Shell strictly requires the PHP interpreter to be running on the server. Sites built on Next.js, Nuxt, Astro, Python (Django/Flask), Ruby on Rails, or Go are completely immune by architecture. Naive scanners may false-flag these sites — ours uses deep multi-signal fingerprinting to prevent false positives.
Emergency security patches: PHP 8.2.35+, PHP 8.3.36+, PHP 8.4.27+, and PHP 8.5.12+. For PHP 5.x–8.1.x, there are no official patches because those branches are End of Life (EOL) — you must upgrade to a supported branch.
Temporary mitigations include setting 'session.upload_progress.enabled = Off' in php.ini, configuring PHP-FPM with 'pm.max_requests = 100' to aggressively cycle worker processes, and deploying WAF virtual patching rules to drop abnormal multipart file upload headers.
Modern servers and WAFs hide the PHP version in response headers (a best practice). Our scanner can detect PHP presence but cannot read what's not disclosed. Use the version verification box to paste your local `php -v` output for exact CVE matching.
Yes. All probes are non-destructive: we send standard HTTP GET/HEAD requests and a passive query-string probe with no exploit payloads. No files are written, no forms submitted, no authentication attempted.
Yes — the PDF executive report is completely free with no login required. It includes platform detection, CVE exposure status, port reconnaissance, and remediation commands.
WebKernelAI Pro includes automated DAST, malware scanning, SSL monitoring, and executive security reports for all your domains.