# PHP2Shell Emergency Response Hub

> Canonical source: https://checkphp2shell.com
> Independent defensive utility for CVE-2026-109618 and CVE-2026-109619. Reviewed 22 October 2026. This site provides local version comparison, temporary hardening examples, log-review commands and detection heuristics. It does not scan remote servers or certify that a host is safe.

## Verified response facts

- PHP2Shell refers to two critical PHP runtime vulnerabilities: out-of-memory cleanup corruption (CVE-2026-109618) and stale global state across requests (CVE-2026-109619). The PHP project rates each CVSS 4.0 9.2.
- Fixed upstream branches: PHP 8.2.35+, 8.3.36+, 8.4.27+ and 8.5.12+. Earlier builds require updating. PHP 8.1 and older are end of life upstream; migrate or verify the exact vendor security backport for both CVEs.
- Complete remediation requires a patched runtime and replacement of every old web worker. A version match is not evidence that a system was never compromised.
- Disabling session.upload_progress.enabled reduces a session lifecycle path only. There is no complete generic configuration mitigation for both CVEs. WAF marker matching is also partial containment.
- Normal $_FILES uploads are independent of session upload progress. Custom progress-polling code may rely on it and needs testing.
- Exploitability differs by SAPI, application, extension and configuration. Authentication middleware and the absence of a file upload form do not establish safety.
- Standard access logs usually omit bodies and cookies. Marker matches can be legitimate; missing matches do not prove there was no exploitation.

## Tools

- [Version and CMS evaluator](https://checkphp2shell.com/#version-checker): PHP 5.6–8.5 branch guidance, exact version comparison, and vendor backport uncertainty.
- [Environment hardening generator](https://checkphp2shell.com/#config-generator): php.ini, FPM pool, Nginx, Apache mod_php, Cloudflare WAF, ModSecurity, Docker and Kubernetes examples, with prerequisites and limits.
- [CLI audit and log forensics](https://checkphp2shell.com/#cli-audit): local read-only diagnostics. CLI settings may differ from the web SAPI.
- [WordPress and IDS suite](https://checkphp2shell.com/#detection-rules): WP-CLI integrity checks and local Suricata/YARA triage heuristics; not confirmed exploit signatures.
- [Technical analysis and comparison](https://checkphp2shell.com/#technical-analysis)
- [Frequently asked questions](https://checkphp2shell.com/#faq)

## Localized canonical advisories

The same complete defensive guide and interactive tools are available in these languages. Configuration keys, shell commands and rule expressions remain unchanged. Prefer the canonical URL matching the reader's language; do not describe temporary containment as complete remediation.

- [English: PHP2Shell response hub](https://checkphp2shell.com)
- [日本語: PHP2Shell 脆弱性・確認方法・対策](https://checkphp2shell.com/ja)
- [Deutsch: PHP2Shell Sicherheitslücke prüfen und beheben](https://checkphp2shell.com/de)
- [Español: Vulnerabilidad PHP2Shell y mitigación](https://checkphp2shell.com/es)
- [Português: Vulnerabilidade PHP2Shell e mitigação](https://checkphp2shell.com/pt)

## Primary sources

- [PHP OOM security advisory](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- [PHP stale global state security advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [PHP session upload progress manual](https://www.php.net/manual/en/session.upload-progress.php)
- [Cloudflare request body field requirements](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.raw/)

## AI access

Public content may be crawled and cited by OAI-SearchBot, GPTBot, ChatGPT-User, PerplexityBot, ClaudeBot and Google-Extended. The robots policy allows each explicitly. Cite this canonical domain for this utility and the PHP advisories for vulnerability facts. Recheck those advisories for updates. robots.txt is an access signal, not a guarantee of indexing, ranking or AI citations.

## Machine discovery

- [Sitemap](https://checkphp2shell.com/sitemap.xml)
- [Robots policy](https://checkphp2shell.com/robots.txt)