← tools

PHP2Shell Patch Tracker

OpenAI's PHP version checker, running in your browser. Paste a PHP version, a response header, php -v output, or a site address and get the same verdict OpenAI's php2shell-checker gives — OK, potentially vulnerable or unknown — with the same version table and the same caution about vendor backports. Then keep a running tracker of the PHP systems you are responsible for and where each one stands.

What this is about. On 21 October 2026 PHP shipped emergency releases for two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, together known as php2shell. They allow unauthenticated remote code execution and memory disclosure on any affected PHP version back to 5.4, regardless of the application on top. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; older branches depend on vendor backports or an upgrade. Verdicts here are version-based only: no exploit probes are ever sent.

Check a version, a header, or a site

A PHP version (8.4.26), a response header (X-Powered-By: PHP/8.3.36), php -v output, or a URL. One per line to check several at once.

try:

Checking a URL from a browser is a long shot: most sites do not let a page read their Server and X-Powered-By headers, so the result is usually unknown. When that happens the tool hands you the exact terminal command for OpenAI's checker instead.

Tracker

One row per system. Checking something with the same name again updates its row instead of adding a new one. Click a name, version or note to edit it. Everything is stored only in this browser (localStorage) on this device.

Fixed releases, by branch

PHP branch	Fixed release	What the checker says
8.5	8.5.12	OK from 8.5.12 up. Anything lower is potentially vulnerable.
8.4	8.4.27	OK from 8.4.27 up.
8.3	8.3.36	OK from 8.3.36 up.
8.2	8.2.35	OK from 8.2.35 up. PHP 8.2 reaches end of life on 31 December 2026, so plan the upgrade too.
8.1, 8.0, 7.4	source patch only	Always potentially vulnerable by version, whatever the patch number (8.1.35 included). PHP published source patches but no official binaries; rely on your vendor's backport, listed below.
7.3 and older, back to 5.4	no upstream fix	Always potentially vulnerable by version. Vendor backport (for example Ubuntu Pro or Red Hat) or upgrade.
8.6 and later, prereleases	—	Unknown: the checker has no fixed release to compare against, and `RC`, `beta`, `alpha` and `dev` builds are not judged.

Source: the PHP advisory of 21 October 2026 and the version table in openai/php2shell-checker.

Vendor packages that carry the fix

Distributions backport the fix into their own package numbers, so a version that looks too low can still be patched. These are the fixed package versions listed in OpenAI's server-side skill, verified on 22 October 2026. Compare the full package revision of the package that actually serves the site (php8.3-fpm or libapache2-mod-php8.3, not the php metapackage) with dpkg --compare-versions or RPM ordering, and use the listed version or later from the same release and stream.

Release and package	Fixed package version	Advisory

Other providers have their own advisories. Do not apply these thresholds to another vendor's packages or to a custom build. A fixed package also does not prove the web workers use it: confirm which installation serves the site and that PHP-FPM or the web server restarted after the update.

Run OpenAI's checker itself

The real checker is a small Node script, Apache-2.0 licensed, with two Codex skills: one for when you only have a URL and one for when you have server access. From a terminal it reads the site's real response headers, which a browser page usually cannot.

Install both skills in Codex

$skill-installer install both skills from https://github.com/openai/php2shell-checker

Or clone and run it directly

git clone https://github.com/openai/php2shell-checker && node php2shell-checker/phpcheck.js "https://example.com" --json

Just look at the headers yourself

curl -sI "https://example.com" | grep -iE '^(server|x-powered-by):'

On the server, find the package that actually serves the site

php-fpm -v 2>/dev/null || php -v; dpkg-query -W -f='${binary:Package} ${Version}\n' 'php*-fpm' 'libapache2-mod-php*' 2>/dev/null; rpm -qa 'php*' 2>/dev/null

Exit codes: 0 OK, 1 potentially vulnerable, 3 unknown, 2 bad arguments. Add --json for machine-readable output.

How it unfolded

August 2026
Ryan Austin at Calif finds the flaw with GPT-5.6 Sol during an audit of PHP's source under OpenAI's Patch the Planet initiative. On 19 August, Wiz Research independently finds the first bug with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and confirms unauthenticated remote code execution on Drupal and WordPress within two days.
24 August
Wiz reports the vulnerabilities to the PHP security team.
21 September
PHP acknowledges the reports and begins a coordinated fix, with OpenAI, Wiz, Cloudflare and others preparing protections ahead of disclosure.
20 October
Details leak online. PHP gives advance notice of the security release; CERT-EU, the UK's NCSC and others advise organisations that cannot patch immediately to take sites offline, and many government sites go dark.
21 October
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 ship. Public disclosure by PHP, Wiz, Calif and OpenAI, which publishes the version checker this page is built on.
22 October
OpenAI's server-side skill lists the Debian, Ubuntu and Red Hat package versions that carry the backported fix.

Sources

openai/php2shell-checker — the checker and skills this page ports (Apache-2.0)
Patch the Planet: global response coordination — OpenAI, 21 October 2026
PHP security advisory and releases — php.net
Today's PHP security release — The PHP Foundation
PHP2Shell: AI uncovers critical RCE vulnerabilities — Wiz Research, with indicators of compromise
Calif's write-up — the other discoverer
Cloudflare's WAF protections — interim mitigation, not a fix
CISA BOD 26-04 — how to prioritise remediation
CVE-2026-109618 and CVE-2026-109619 — NVD
patchtheplanet.org — public disclosures and operator guidance

A version check is a hint, not a verdict. This page reproduces the classification logic of OpenAI's php2shell-checker (Apache License 2.0, © OpenAI) and is not affiliated with OpenAI or the PHP project. OK means only that the advertised version meets an upstream fixed release; the installed build is not verified. Potentially vulnerable is a version-based warning, never confirmed vulnerability; a vendor backport may already contain the fix. Headers can be changed or hidden, and a server-side check of the package serving the site is stronger evidence. Nothing here sends exploit probes. The tracker lives only in this browser's local storage. Always confirm against the PHP advisory and your vendor's guidance before deciding.