Memory-exhaustion error handling
When memory exhaustion interrupts a request, PHP may use invalid internal data during cleanup. Under suitable conditions, this can lead to remote code execution.
PHP developers’ technical advisoryDEV4YOU.LT / PHP2SHELL
PHP security check for your website.
Assess your exposure to CVE-2026-109618 and CVE-2026-109619. Confirm your email and receive a PDF with the findings and recommended next steps.
Understand the risks and what to doLoading the check…
OFFICIAL RELEASES
PHP versions containing the fixes
PHP published these fixes on 21 October 2026. Use these releases or a newer release in the same branch, or confirm the vendor’s backported fixes.
PHP 8.28.2.35
PHP 8.38.3.36
PHP 8.48.4.27
PHP 8.58.5.12
WHY CHECK NOW
A PHP vulnerability can affect the whole application.
PHP runs website code on the server: it handles forms and sign-ins, communicates with the database and generates pages. The vulnerabilities known as PHP2Shell affect this runtime layer, so a well-maintained content management system also needs its PHP environment checked.
Successful exploitation can allow code execution with the PHP worker’s privileges. This does not automatically grant server administrator access, but the files and data available to the application may still be critical to the business.
Official PHP security advisoryStale state between requests
A PHP worker may retain a reference to memory released after an earlier request. Later use of that reference can disclose information or enable code execution.
PHP developers’ technical advisoryWhich websites need attention?
WordPress, WooCommerce, Laravel, Symfony and custom PHP applications. PHP’s advisory covers web runtimes including PHP-FPM, Apache mod_php, CGI, LiteSpeed and FrankenPHP, with the highest risk identified for mod_php. Using a different server interface does not replace patching.
POSSIBLE IMPACT
What could happen to the website and its customers?
The following are possible consequences if exploitation succeeds. They are not incidents detected by this check. Actual impact depends on worker privileges, isolation between websites and the application’s architecture.
Data exposure
Access to configuration files readable by PHP could expose database credentials or integration keys. Enquiry, customer or order information accessible to the application could then be at risk.
Altered content and transactions
Where the worker has write access, pages or application files could be modified. Visitors might, for example, be redirected to another website or shown altered payment instructions.
Interrupted orders and services
PHP worker failures can cause errors, failed forms or incomplete purchases. The business then needs to restore service, verify data integrity and communicate the interruption to customers.
Persistent unauthorized access
A malicious file or unauthorized account could remain after PHP is updated. A suspected compromise therefore needs separate incident analysis and an application review.
What does your result mean?
We assess the available PHP version evidence against the official fixed releases. An affected version and a confirmed compromise are separate findings.
Update needs attention
Interpretation
The observed version predates the official fixed release. A vendor may have applied backported fixes without changing the upstream version.
Next action
Confirm both CVE fixes with the vendor or install a patched PHP package.
Obsolete PHP branch
Interpretation
An old PHP branch is in use. This check cannot establish whether a particular LTS vendor still maintains that package.
Next action
Verify vendor maintenance and plan a compatible upgrade to a supported branch.
PHP2Shell fixes present
Interpretation
The detected PHP release includes both PHP2Shell fixes. No additional PHP update is needed for these two vulnerabilities.
Next action
Continue normal website maintenance.
Insufficient evidence
Interpretation
The version is hidden, the response is unavailable, the evidence conflicts or the branch cannot be reliably compared. Patch status remains unconfirmed.
Next action
Check PHP in the hosting panel or use the optional runtime diagnostic.
ACTION PLAN
How should the issue be addressed?
Identify the actual PHP runtime
Check the PHP version and package assigned to this website. Command-line PHP can differ from PHP-FPM. Different domains, servers or containers may use different versions.
Prepare recovery and compatibility checks
Back up files and the database, and confirm recovery is possible. Review the CMS, plugins, themes and PHP extensions. Where possible, test the change in a separate environment first.
Install the patched package
Use a fixed release or a vendor package explicitly covering both CVEs. Updating WordPress, a plugin or a theme does not update the server’s PHP runtime.
Replace the running workers
The administrator needs to ensure every PHP worker and every server serving the site uses the patched code. Verify the web PHP version again after the change.
Verify the important application flows
Check sign-in, forms, administration, checkout and integrations. Review error logs. Where compromise is suspected, a successful update alone is not enough to close the incident.
PREPARING YOUR SYSTEM FOR NEWER PHP
Does your system lack support for a newer PHP version?
If your content management system, online shop or custom PHP application does not support a newer PHP version, contact Dev4you.lt. We can assess the compatibility issues, rewrite outdated parts of the code and prepare your system for a supported PHP version.
We offer assistance regardless of the CMS or original developer, covering both established platforms and custom systems. The upgrade may be blocked by the application core, theme, modules, libraries, integrations or custom code. We review that full dependency chain and choose an approach appropriate for your system.
Compatibility review
We review PHP and CMS releases, modules, libraries and custom code. We identify what blocks the upgrade, which changes are needed and which supported PHP branch suits the planned solution.
Code and module adaptation
We can update dependencies, adapt code to changes in PHP function behavior and error handling, and rewrite outdated custom modules. For unmaintained components, we assess a replacement or targeted redevelopment.
Test environment and functional checks
We prepare backups and a test environment. There we check sign-in, forms, orders, payments, integrations and background tasks. The checks are scoped around your business processes and how the system is used.
Agreed rollout and maintenance
We agree on scope, priorities and rollout timing, and prepare a recovery plan. After deployment, we confirm the running PHP environment and repeat the important functional checks. Ongoing maintenance is agreed around your needs.
The work can range from fixing one module to broader system modernization. We choose an approach after reviewing source-code access, licenses, integrations and vendor support. The aim is to preserve important business functions and prepare the system for a PHP branch that receives security fixes.
Discuss PHP compatibility work
Tell us which system and PHP version you use, what fails during an upgrade and which integrations matter most. This information helps us discuss the next assessment steps and a work plan.
ASSESSMENT SCOPE
What can this check establish?
The automatic check reads a public website response and the PHP version signals it exposes. It does not execute an exploit, provoke memory exhaustion or establish that malicious files are absent. Email verification gives access to a summary and a detailed PDF report.
Additional runtime confirmation
If you control the website files, the optional diagnostic can report the PHP version, interface and a limited set of settings for that path. Remove the file after use. The observed version must still be considered alongside the vendor’s patch information.
Return to the checkHow do you check PHP versions across different systems?
The PHP version belongs to the server runtime serving the website. You can check it through the CMS, hosting panel or optional diagnostic. Choose your system below; menu labels can vary by version and interface language.
In the CMS administration
Optional Dev4you.lt diagnostic
This method also works for other PHP applications if you control their files. The result describes the runtime executing the uploaded file.
- Complete the check. Once the PDF has been passed to the mail service, expand “Confirm PHP directly on your server” in the results and download the diagnostic file.
- Use the hosting file manager or SFTP to upload it at the exact URL shown by the check. Use the website’s public document root and the same PHP runtime.
- Return to the results and select “I uploaded the file — check PHP”. Once verified, we update the summary and prepare a new PDF using the observed PHP data.
- Remove the uploaded file after checking. If you are unsure which runtime serves it, ask the hosting administrator for help.
With SSH access
To inspect the command-line PHP version, run:
php -vThis reports the PHP binary used by the command line. The website may use a different PHP-FPM, Apache or container runtime, so this number alone does not establish the website’s PHP version. Also verify the runtime assigned to the web application.
PHP command-line referenceRecord the full PHP version, the checked domain and the time. Where the vendor backported fixes into an older package, request the full package release and confirmation of both CVE fixes.
Common questions
The website works normally. Does it still need checking?
Yes. Normal page behavior does not establish that PHP is patched. Small brochure websites also need maintenance: automated attacks do not reliably distinguish targets by business size.
Do HTTPS, CAPTCHA or a security plugin solve this?
HTTPS protects the connection and CAPTCHA helps limit form abuse. Neither repairs PHP memory handling. Some attack paths are reached before application code runs, so application-level protection cannot substitute for a PHP patch.
Does an older version number always mean it is unpatched?
No. A distribution or LTS vendor may backport the fixes. Ask for the exact package release and confirmation covering CVE-2026-109618 and CVE-2026-109619. A general statement that everything is up to date is insufficient evidence for the assessment.
What if the PHP version is hidden?
Use the instructions above for WordPress, Joomla, Drupal, PrestaShop and other PHP systems. You can also check through the hosting panel or this tool’s optional diagnostic. Hiding the version gives no evidence about installed security fixes.
Can temporary PHP configuration changes be sufficient?
The official measures reduce exposure to particular attack paths, but they are not a complete fix. An administrator needs to assess them against the environment, workload and resource limits. A patched PHP runtime remains the primary solution.
What should I ask the hosting provider?
Ask for the web PHP version and full package release assigned to this site, confirmation of both CVE fixes and confirmation that all running workers use the updated code. Include the check time and PDF so the provider can address the exact evidence.
HELP AFTER THE CHECK
How can Dev4you.lt help?
From explaining a finding to an agreed update and post-update verification. The work is scoped around the actual environment and the functions important to your business.
Discuss the PHP check resultEnvironment review
PHP versions, packages, site assignments and the evidence supplied by the hosting provider.
Update preparation
Backups, compatibility review and an agreed change procedure.
Implementation and verification
PHP updates, runtime confirmation and functional checks.
Suspected incident review
Review of logs, files and access, followed by a plan for recovery work.