Free · no sign-up

Response Centre: check it, fix it, free.

What this is

When a critical vulnerability breaks, we publish a free page to check whether you are exposed and fix it: a safe check you can run on your website, commands for your server, patch steps for each platform, stopgaps and signs of compromise. No sign-up.

ActiveCritical, CVSS v4 9.2·CVE-2026-109618, CVE-2026-109619
php2shell: critical PHP remote code execution (CVE-2026-109618, CVE-2026-109619)
Two flaws in PHP itself let an attacker run code on a web server without logging in. One corrupts memory when PHP runs out of memory; the other reuses state left over from an earlier request. Every PHP installation that serves web requests is exposed until it runs PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. PHP 8.1 and older get no fix.
Check and fix

Response Centre: check it, fix it, free.

php2shell: critical PHP remote code execution (CVE-2026-109618, CVE-2026-109619)