Current situation: PHP2Shell. Two critical PHP vulnerabilities (CVSS 9.2) allow malicious code without login. Patches since 21 October 2026.What to do now →

Tools for a real emergency

Everything runs in your browser. No data is sent to us unless you send the result yourself via WhatsApp.

Check PHP version

Compares your version with the patched versions of 21 October 2026.

Enter the PHP version or paste the output of php -v

Runs only in your browser, nothing is sent. Basis: security announcements from php.net of 21 and 23 October 2026. Distribution backports sometimes do not change the number.

Quick test independent of the version number

According to the PHP manual, the setting memory_hard_limit_percent came with the patches. If your PHP does not know it, it is affected:

php -r 'var_dump(ini_get("memory_hard_limit_percent"));'

bool(false) means: unknown, hence affected. Check each installed PHP version individually; the command line may use a different version from the web server.

Generate interim measures

Configuration lines according to php.net for your operating mode.

Your operating mode

Uploads needed PHP 8.5

Interim measures according to php.net, no substitute for the update. memory_limit=-1 only together with a memory limit via container or cgroup. Back up the configuration first.

Calculate the 72-hour deadline

Deadline under Art. 33 GDPR from awareness of the data breach. General information, not legal advice.

When did you learn of the data breach?

Immediate contact

Every hour counts. Write to us now.

Briefly describe your system, PHP version and observation. We will get back to you, clarify the situation and work remotely until the incident is closed and documented.

WhatsApp emergency Call

Tools for a real emergency

Check PHP version

Emergency check

Generate interim measures

The first hour

Calculate the 72-hour deadline

Every hour counts. Write to us now.