PHP2Shell.

Know your risk.
Take action.

Check for signs of PHP2Shell exposure and find your next step with Imperva security experts.

Talk to an expert

PHP2Shell checker

Is your site exposed?

Start with your URL. Check for signs of PHP2Shell.

.

Results may require further verification.

  1. Enter your URL

    Start the check in seconds.

  2. Review the signals

    We’ll look for signs of PHP2Shell exposure.

  3. Find your next step

    Get guidance from Imperva security experts.

PHP2Shell advisory

Two critical paths to remote code execution.

PHP2Shell covers two memory-safety vulnerabilities that can leave request or global memory in an invalid state after PHP exits an error-handling context.

Read the PHP2Shell vulnerability update

CVE-2026-109618

Critical CVSS 4.0: 9.2

Remote code execution via out-of-memory handling

PHP uses longjmp() to exit the current context when an out-of-memory error occurs. Some contexts may not account for that exit and can leave request memory uninitialized. Cleanup for the request may then read or branch on that memory. Multiple out-of-memory strategies can consistently trigger the condition and lead to remote code execution.

Weakness
CWE-824 — Access of uninitialized pointer

CVE-2026-109619

Critical CVSS 4.0: 9.2

Remote code execution via fatal-error handling

PHP uses longjmp() to exit the current context after a fatal error. Some contexts may leave global memory pointing into request memory that is freed at the end of the request. Subsequent requests may read or branch on the invalid memory. Multiple fatal-error strategies can trigger the condition and produce remote code execution.

Weakness
CWE-824 — Access of uninitialized pointer

Clarity when it matters.

Understand your exposure

Find out whether your website shows signs of PHP2Shell exposure.

Get expert guidance

Talk through your PHP2Shell concerns with an Imperva security expert.

Get ahead of PHP2Shell.

Start a free trial of Imperva, or talk to us about your exposure and next steps.

Start free trial Talk to a PHP2Shell expert

Use of this tool

Terms for using this checker

This tool provides an indicative assessment for informational purposes only, based on publicly accessible information returned in response to standard web requests. It does not inspect application source code, access internal systems, or attempt to exploit vulnerabilities. Results may be incomplete or inaccurate.

PHP usage, version information, and relevant configuration details may be hidden or unavailable. Detection of PHP or an apparent version does not establish that a website is vulnerable to a particular CVE, and a negative or inconclusive result does not establish that PHP is absent or that the website is secure. Results are not a substitute for a comprehensive security assessment.

Website owners should independently verify their PHP version, configuration, patch status, and the applicability of any referenced CVE before making security or remediation decisions.

THIS TOOL IS PROVIDED “AS-IS” AND IMPERVA MAKES NO REPRESENTATIONS, CONDITIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, WITH RESPECT TO THE TOOL, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, INFORMATIONAL CONTENT, SYSTEM INTEGRATION, ENJOYMENT, NONINFRINGEMENT OR ANY OTHER WARRANTIES ARISING OUT OF COURSE OF DEALING, USAGE OR TRADE. IN NO EVENT SHALL IMPERVA’S TOTAL AND AGGREGATE LIABILITY IN CONNECTION WITH THE USE OF OR INABILITY TO USE THE TOOL EXCEED ONE HUNDRED DOLLARS ($100).