PatchMyPHP launches a free PHP vulnerability checker that shows website owners in under a minute whether the October 2026 PHP flaw (CVE-2026-109618) leaves them exposed
Austin, Texas – October 23, 2026 – PatchMyPHP today launched a free PHP vulnerability checker that shows website owners in under a minute whether the October 2026 PHP flaw (CVE-2026-109618) leaves them exposed. The checker is live at patchmyphp.com and requires no account.
The vulnerability is two critical bugs in PHP itself: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), nicknamed “PHP2Shell” by researchers at Sansec, SOCRadar, watchTowr and Rapid7. PHP rates them CVSS 9.2 under CVSS 4.0, and the NVD scores them 9.8 under CVSS 3.1. Both allow unauthenticated remote code execution. CVE-2026-109618 is a memory-corruption bug triggered during out-of-memory handling, for example during a file upload. CVE-2026-109619 is caused by stale global state being reused across requests after a fatal error.
Because the bugs live in the PHP runtime, the vulnerability reaches essentially every PHP web install: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP shipped fixes on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end of life and received only source backports (7.4, 8.0 and 8.1), with no normal release.
Exploitation status is still developing, and PatchMyPHP is careful not to overstate it. Rapid7 expects a working public exploit imminently, watchTowr reports in-the-wild activity, and Sansec assesses that mass exploitation is less likely than first feared. The flaw is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. The practical takeaway: it is critical, it is patched, an exploit is expected imminently, so owners should check and patch now.
The free PHP vulnerability checker answers the first question every owner asks: is my site vulnerable? Enter your website address. PatchMyPHP reads the PHP version your server reports publicly and tells you, plainly, whether that version carries the fix. When a server hides its version, the checker says so instead of guessing, and never calls a site vulnerable without a version string that proves it. Want certainty? Install the free read-only agent, a WordPress plugin or a single PHP file, and PatchMyPHP reads the real version straight from inside your server.
WordPress owners should hear one thing clearly. This fix lives at the server and PHP layer. Updating WordPress core, plugins or themes does not close PHP2Shell. Only the host or server operator updating PHP does.
“The fix for this one lives on the server, not in WordPress, so an owner can update every plugin they have and still be wide open,” a PatchMyPHP spokesperson said. “We built the checker to give owners the truth in under a minute, and to say so plainly when a site hides too much to tell from the outside.”
For ongoing coverage, PatchMyPHP also offers paid continuous monitoring that watches a site around the clock for the signs of a live break-in and for each new PHP security release.
Owners can check their own site at patchmyphp.com. Background is available in the official PHP security advisory at php.net and the CERT-EU advisory.
About PatchMyPHP
PatchMyPHP helps website owners understand and close PHP security exposure, combining a free, evidence-based PHP version checker, a free read-only agent for an exact in-server reading, and paid continuous monitoring for live-compromise signs and new PHP releases. PatchMyPHP never claims a site is vulnerable without a version string that proves it.
Contact
PatchMyPHP
https://patchmyphp.com
Media Contact
Company Name: PatchMyPHP
Contact Person: Media Relations
Email: Send Email
City: Austin
State: Texas
Country: United States
Website: https://patchmyphp.com
 leaves them exposed){kind=link}