Check your website for php2shell exposure. Get a free, quick security check for your PHP website.
Try the php2shell CheckerFind out if your website shows signs of exposure to the php2shell PHP multipart vulnerability — and how to fix it.
Free · Passive check only · Results in seconds
By using this tool, you confirm and agree that:
Server, X-Powered-By). It never sends exploit payloads or attempts to trigger a crash.Questions about these terms? Contact us.
php2shell refers to CVE-2026-109618 and CVE-2026-109619 — vulnerabilities
in how PHP parses deeply-nested multipart/form-data request bodies. Documented by the Calif
team and turned into a detection tool by Assetnote's security research team.
A form submission with unusually deep field nesting arrives at the server.
PHP builds an internal structure to represent every nested field level.
On unpatched builds, that structure balloons far past the request's actual size.
The PHP process hits its memory limit and fails — an out-of-memory fatal or FPM worker crash.