PHP vulnerability check (PHP2Shell)
PHP security check: checks whether a website is affected by the critical BSI-reported “PHP2Shell” vulnerability (CVE-2026-109618, CVE-2026-109619) or already patched. Passive request, nothing is stored, with a BSI source reference.
Background
The BSI warns of two critical PHP flaws.
The German Federal Office for Information Security (BSI) has warned since 21 October 2026 of two critical vulnerabilities in the PHP programming language (CVE-2026-109618 and CVE-2026-109619, also referred to as “PHP2Shell”; CVSS 4.0 score 9.2 out of 10; BSI risk level orange). According to the BSI, all known PHP versions are affected. Exploitation requires neither authentication nor any action by website visitors and could allow attackers to execute code remotely on the web server. Patches have been available since 21 October 2026, 16:00 CEST: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; backport patches without a fixed version number exist for the already end-of-life versions 7.4, 8.0 and 8.1. Source: BSI security advisory BITS-H No. 2026-297981-1132, version 1.1 of 21 October 2026.
Need help patching or checking your PHP version?
fontax checks, patches and monitors PHP web servers and applications – on short notice too.