Astra SecurityPHP2Shell Checker
Critical · CVSS 9.8CVE-2026-109618CVE-2026-109619

Are you affected by PHP2Shell?

A critical flaw in the PHP runtime’s multipart parser chains denial of service into remote code execution. Check the PHP release behind any URL and leave with one clear next step.

Run the checkRead the advisory
CVSS 9.8
Critical severity
2 CVEs
Chained flaws
4 branches
Patched: 8.2–8.5
No auth
Network, no login
Response signalHEAD /
HTTP/1.1 200 OK
X-Powered-By: PHP/8.3.36
Server: nginx

How the checker reads it

8.3.0 – 8.3.35Update required
8.3.36 or newerPatched

Run the check

Is your deployment patched?

Enter a public URL. The checker reads the PHP release it is serving and compares it with the fixed builds and with no account.

Bounded request · No account · No response body stored

The findings

What has been discovered

PHP2Shell is two linked flaws in the PHP runtime’s multipart parser. Reported privately, fixed on every supported branch, and now public. Here is the full picture.

Critical severity

PHP2Shell

Severity
Critical · CVSS 9.8
Attack vector
Network · Unauthenticated · No user interaction
Affected component
ext/standard multipart/form-data parser (rfc1867)
Exploitation
Proof of concept public. No confirmed exploitation in the wild at disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2026-109618

Multipart body memory exhaustion

A crafted multipart/form-data request forces unbounded allocation while the parser walks part headers, exhausting worker memory and taking the process down.

CVE-2026-109619

Multipart boundary out-of-bounds read

A malformed boundary makes the same parser read past its allocation, disclosing adjacent process memory. Chained with the first flaw it can be driven toward code execution — the step that names PHP2Shell.

Affected & fixed releases

  • PHP 8.5≥ 8.5.12
  • PHP 8.4≥ 8.4.27
  • PHP 8.3≥ 8.3.36
  • PHP 8.2≥ 8.2.35
  • PHP 8.1 and olderEOL

Any release below its branch’s fixed build is exposed. Branches 8.1 and older no longer receive security fixes.

Primary sources

What is PHP2Shell

One request, four steps to a shell

The weakness lives in how PHP parses multipart form data — the same code path behind almost every file upload. Each flaw is serious on its own; chained, they are critical.

  1. 01

    A crafted multipart upload

    An attacker sends a malformed multipart/form-data body to any endpoint that accepts uploads. No login and no user interaction are required.

  2. 02

    The parser over-allocates

    Walking the part headers, the rfc1867 parser allocates without bound (CVE-2026-109618) and the PHP worker exhausts its memory.

  3. 03

    Memory leaks out

    A malformed boundary then reads past the allocation (CVE-2026-109619), returning fragments of adjacent process memory to the attacker.

  4. 04

    The chain reaches a shell

    Leaked pointers defeat memory-layout defenses, and the two flaws together can be steered toward remote code execution — hence PHP2Shell.

Disclosure timeline

What has happened so far

PHP2Shell followed coordinated disclosure: reported in private, patched before the details went public, so the fix was available the day the advisory landed.

  1. Jul 2026

    Reported privately

    The multipart parsing behaviour was disclosed to the PHP security team under coordinated disclosure.

  2. Aug 2026

    Root cause confirmed

    The flaw was traced to the rfc1867 multipart parser. CVE-2026-109618 and CVE-2026-109619 were reserved.

  3. Sep 2026

    Coordinated fixes shipped

    Patched builds landed on every supported branch: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

  4. Oct 2026

    Public disclosure

    GitHub Security Advisories and the CVE records were published alongside a proof-of-concept.

How it works

One signal, interpreted carefully.

The checker stays deliberately narrow so the result remains useful and honest.

01

See the version the URL is serving

The check reads X-Powered-By and Server. If those headers are hidden, you can enter the PHP version yourself.

02

Know whether that release is fixed

Fixed means PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a newer supported release. Anything older on those branches needs an update.

03

Understand what the result proves

A matched release confirms the PHP2Shell fixes for that branch. It is not a general security guarantee for the website.