php2shell
PHP engine RCE
An unauthenticated remote-code-execution flaw in the PHP interpreter itself, not a framework or plugin. It runs before your code does, which is why a clean application on a vulnerable engine is still exploitable. Below is the live global exposure.
Why a clean app doesn't save you
php2shell is the shared name for two critical bugs, CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state). Both are rated CVSS 9.2 and both give an unauthenticated attacker remote code execution.
The flaw lives in the PHP interpreter that parses the request, before any of your code runs. A clean, zero-dependency "Hello World" app on a vulnerable engine is still exploitable. That is why version inventory alone misses it.
Check if your server is vulnerableThe two vulnerabilities
Exposed hosts by PHP version
Red branches (PHP 5.x, 7.x, 8.0, 8.1) are end-of-life and get no official php2shell fix. Roughly four in five PHP servers hide their version, so every count here is a floor.
Exposure breakdown
Where unpatchable PHP concentrates, and how this threat scores across the standard risk signals.
Top countries by unpatchable PHP
Internet-facing hosts on EOL PHP (version-disclosed)
Exposure by region
Share of unpatchable PHP hosts worldwide
Threat scoring
As of 2026-10-22
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NIs your server exposed?
Run the free php2shell scanner against a server you own. Crash-based detection, a verdict in seconds.
Open the php2shell scanner