Scan your website for PHP2Shell.
Check an authorized target for CVE-2026-109618 and CVE-2026-109619 with SmartScanner's passive detection and harmless active tests. The scan runs from your Windows PC, not from a hosted scanner.
Start a PHP2Shell scan
Enter your URL to open the target in SmartScanner. Choose the PHP2Shell test and start it in the app.
Windows app 3.1 or later required. Free scans; Pro unlocks full finding details. Only scan authorized systems.
A targeted check for PHP runtime exposure
Know what you are testing
What is PHP2Shell?
PHP2Shell refers to two critical PHP runtime vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Because the flaws are in PHP itself, they can affect applications on different CMSs and frameworks when those apps use a vulnerable runtime.
The fix depends on the PHP branch and package vendor. A version banner can be misleading when a Linux distribution backports security fixes without changing the upstream version number. Check the package changelog as well as the version reported by your server.
Run a PHP2Shell check
- 01
Enter an authorized URL
Use a public application or test environment you own or have explicit permission to assess.
- 02
Run the PHP2Shell test
The URL opens in SmartScanner on Windows. Choose the PHP2Shell test and start the scan; entering a URL alone does not run it.
- 03
Review, remediate, and retest
Investigate the finding, update affected PHP packages, restart relevant services, then scan again.
Test and verify
A scan result is a signal. Confirm the runtime and patch.
SmartScanner checks for PHP2Shell with both passive detection and harmless active tests. Use the results to focus your investigation; they do not inventory every PHP installation or replace package-level verification.
Test the URL you choose
Run SmartScanner's passive detection and harmless active tests against an application you own or have permission to assess.
Review the results
Use both kinds of check to guide your investigation, then confirm the PHP package and patch status.
Run the scan from your PC
SmartScanner sends scan requests from your Windows computer to your target. Your assessment runs in the app, not on a hosted scanner.
This page starts a scan of one target at a time; it does not discover your full PHP asset inventory. Check containers, workers, PHP-FPM pools, and other runtimes separately.
PHP patch guidance
Check the fixed release for your PHP branch.
PHP's upstream security releases include fixes at these versions. If you use distribution-managed PHP, check your package vendor's advisory: a backported fix may use a different version string.
| PHP branch | Upstream fixed release | Release notes |
|---|---|---|
| 8.5 | 8.5.12 | PHP 8.5.12 security release |
| 8.4 | 8.4.27 | PHP 8.4.27 security release |
| 8.3 | 8.3.36 | PHP 8.3.36 security release |
| 8.2 | 8.2.35 | PHP 8.2.35 security release |
| 8.1 and earlier | No upstream fixed release | Check for a vendor backport or upgrade to a supported branch. |
Check the PHP package and security advisory from your operating-system or hosting vendor, especially for older branches. A clean website scan does not confirm that every PHP runtime in your environment is patched.
What to do next
A scan is the start of remediation.
If PHP2Shell is detected, inventory all PHP runtimes serving the application, including containers, PHP-FPM pools, workers, and other deployment environments. Upgrade to a PHP release containing the fix or apply a verified vendor backport, then restart the affected PHP services.
Follow the vendor guidance for your operating system and PHP package. Do not treat memory limits or a web application firewall as a replacement for patching. If a vulnerable service was exposed, follow your incident-response process to investigate and protect credentials.
Go deeper
- PHP2Shell vulnerability details — learn how SmartScanner's passive detection and harmless active tests check for exposure, with risk context and remediation guidance.
PHP2Shell scanner FAQ
Questions before you scan
Which vulnerabilities does the PHP2Shell scanner check?
SmartScanner checks for CVE-2026-109618 and CVE-2026-109619 using both passive detection and harmless active tests.
Which PHP versions include the upstream fixes?
The PHP 8.5, 8.4, 8.3, and 8.2 branches have fixes in 8.5.12, 8.4.27, 8.3.36, and 8.2.35, respectively. Linux distributions may backport fixes without changing the upstream version number, so check your package vendor's advisory.
What if I use PHP 8.1 or an older branch?
PHP 8.1 and earlier are no longer supported upstream. Check whether your operating-system or hosting vendor provides a security backport. If not, plan an upgrade to a supported PHP branch.
Does SmartScanner scan online?
No hosted scanner runs the test. SmartScanner runs on Windows and sends requests from your computer to the target URL you entered.
Is the PHP2Shell scanner free?
SmartScanner Free includes unlimited scans with no signup or credit card. The Free edition limits vulnerability details; Pro unlocks the full PHP2Shell finding details. See plans and pricing.
Does entering a URL start the scan?
No. The form opens SmartScanner on Windows with your target URL. Choose the PHP2Shell test and start the scan in the app.
Can I scan any website?
Only scan systems you own or have explicit permission to test. Obtain authorization before assessing any third-party application.
What should I do if the scan finds PHP2Shell?
Confirm the finding against the PHP packages and vendor advisories for your environment. Upgrade to a fixed release or apply a verified backport, restart affected services, and run the check again.
Does a clean result prove that every PHP runtime is patched?
No single website scan proves the state of every server, container, worker, or runtime in your environment. Inventory your PHP deployments and verify package updates directly with your vendors.
Check your authorized application
Ready to check for PHP2Shell?
Enter your URL to open SmartScanner on Windows. Select the PHP2Shell test and start the scan in the app.