Check PHP2Shell patch status

Check for fixes covering both CVE-2026-109618 and CVE-2026-109619. Do not run exploit probes.

Identify the serving installation

Identify the PHP installation serving the site, including its container if applicable. The default CLI PHP may differ from PHP-FPM or Apache's PHP module.

Inspect the serving binary or Apache module and its owning package directly. Determine the OS release and package provider before choosing an advisory.

Check patch status

Compare the full package revision against vendor guidance covering both CVEs. An older upstream version alone does not prove vulnerability. Configuration settings alone do not establish patch status.