Is your PHP exposedto PHP2Shell?Find out in seconds.Then patch it.
Two critical flaws in the PHP engine hand attackers code execution on your web worker. Fixed on 21 October 2026, exploited before that. Everything here runs in your browser. Nothing is uploaded.
Six checks, one scan.
Run everything from the CLI on your server, or paste and drop files into the in-browser checkers. Each check reads only what you give it and reports findings with a fix.
- Version checkerExplore
PHP version & EOL
Paste php -v, phpinfo or an X-Powered-By header and get the verdict: patched, outdated, or end-of-life, with the version to move to.
- Config auditExplore
php.ini & FPM config
Audit effective settings against the PHP2Shell interim mitigations and classic hardening: memory_limit, session.upload_progress, allow_url_include and more.
- composer.lock auditExplore
Composer dependencies
Match every package in composer.lock against the Packagist security-advisories API and get the safe version to update to.
- Code scanExplore
Code & webshells
Scan application code for risky patterns and webshell signatures: PHP hidden in uploads, obfuscated loaders and files changed during the exposure window.
- Crypto exposureExplore
Exposed keys & wallets
Find private keys, seed phrases, RPC URLs with API keys and Solana keypairs in web-served files. Secrets are masked before they are ever shown.
- FixesExplore
Fix playbooks & mitigations
Pick your platform and SAPI for the exact upgrade, restart and verify commands, plus the interim mitigations to apply before you can patch.
Beyond the patch. Guard the browser, watch the wallets.
Code execution on a PHP origin can reach visitors' browsers and any wallet whose key the server could read. These tools cover both, and none of them ever asks for a key or seed phrase.
- HardenExplore
Content-Security-Policy builder
Build a strict policy to set at your CDN or proxy, so browsers refuse scripts from hosts you didn't list. Output for nginx, Apache, Caddy, Cloudflare and _headers.
- SolanaExplore
Wallet watch
Keep checking a Solana address for new transactions and get an alert when the wallet signs one. Runs in this tab, or from the CLI with a Slack, Discord or JSON webhook.
- SolanaExplore
Token delegations
List token accounts that still have a delegate, an approval that lets another address move tokens without your signature, with the revoke command for each.
What happened, with sources.
Only the facts the PHP project and the advisories state. Each item links to where it came from.
- 2026-10-20
Advance notice
The PHP project published "Upcoming Critical PHP Security Release", scheduled for 21 October 2026 at 14:00 UTC. Both vulnerabilities were rated CVSS v4.0 9.2. The team noted it could release earlier if details became public or active exploitation appeared.
php.net/archive/2026.php - 2026-10-21
Fixes released
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped as security releases, each fixing CVE-2026-109618 and CVE-2026-109619: unauthenticated remote code execution. PHP 8.2 reaches end of life on 31 December 2026.
php.net/archive/2026.php - 2026-10-21
Impact confirmed
The advisory states complete remote code execution was validated over HTTP against Apache mod_php; no complete PHP-FPM exploit was demonstrated. mod_php carries the highest risk.
GHSA-w8hw-w9fx-j79w - Ongoing
8.1 and older
PHP 8.1 and older get no official release. The PHP project published minimal source backports for 7.4, 8.0 and 8.1; some distributions and LTS vendors ship them.
GHSA-6wmf-4rv5-p3rp
Running a wallet, bot or Solana node on PHP?
RCE on the web worker means any key readable by that process can be stolen. PHPShield finds exposed keypairs and seed phrases, masks every secret, and lets you check read-only whether a hot wallet has moved funds or still has token approvals, from its public address alone.
On your server, or in CI.
One Python file, standard library only, no dependencies. It inspects the machine it runs on and the paths you give it, and sends nothing about you anywhere.
curl -O https://phpshield.live/downloads/phpshield.pyz python3 phpshield.pyz scan .
python3 phpshield.pyz version 8.3.12 python3 phpshield.pyz scan /var/www --format md
python3 phpshield.pyz monitor /var/www \ --once --webhook "$SLACK_URL"