Advisories
PHP security advisories, curated and triaged.
The advisories PHPShield checks against, each taken from the official PHP source. Every row links to the primary source. For the complete, machine-readable PHP release history, see /data/php-releases.json.
| Details | ||||
|---|---|---|---|---|
CVE-2024-4577 PHP-CGI argument injection on Windows (Best-Fit) | critical | 9.8 v3.1 | 8.1.29 · 8.2.20 · 8.3.8 | GHSA |
CVE-2026-109618 PHP2Shell: RCE via out-of-memory state corruption | critical | 9.2 v4.0 | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 | Advisory |
CVE-2026-109619 PHP2Shell: RCE via stale request state (use-after-free) | critical | 9.2 v4.0 | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 | Advisory |
CVE-2026-111497 Brotli decoder out-of-bounds write (node2shell / HTTP2Shell) | critical | 9.2 v4.0 | 1.2.1 | GHSA |
CVE-2026-115560 Session upload progress with a switched serialize handler | medium | not assigned | Fix lands in the next regular bugfix releases; keep the mitigation until then | Source |
Click a column heading to sort. CVE-2024-4577 is listed in CISA's Known Exploited Vulnerabilities catalogue. It affects Windows php-cgi installs; use the Windows host toggle on the version checker to include it.
PHP2Shell, in depth
The full advisory: what the two flaws are, which SAPIs are exposed, the interim mitigations and the fix.
CVE-2026-109618 · -109619ExploreCheck your version
Paste a PHP version or phpinfo and find out instantly whether you are patched, outdated or end-of-life.
Version checkerExploreFix it
Platform-specific upgrade, restart and verify commands, plus interim mitigations for while you patch.
Fix playbooksExplore