Active threat PHP2Shell · CVE-2026-109618 & CVE-2026-109619 · CVSS 9.2
Is your website exposed? Find out in 30 seconds.
Two critical PHP flaws just made most websites hackable with no password needed. Feli-Scan checks your site free, shows you every weakness in plain English, and fixes it within 24 hours.
19 passive checks from the outside. No login, nothing to install, nothing changes on your site. Runs on felican.ai.
Two bugs in PHP itself put most small-business websites at risk.
On October 21, 2026 PHP shipped emergency releases for CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. The flaws sit in the engine that runs WordPress, WooCommerce, Joomla, Drupal, Magento and most agency-built sites, so an unpatched site can be taken over without a password or any mistake in its own code. US cybersecurity authorities told organisations to patch immediately or take PHP sites offline.
Severity of both flaws. Unauthenticated remote code execution.
Every PHP version from the last 14 years is affected. 8.1 and older will never be fixed.
Proof-of-concept code is circulating and attack attempts were seen within a day.
19 website security checks, the same things attackers look for first.
- PHP2Shell exposure and PHP patch level
- Server and PHP version disclosure
- WordPress, Joomla, Drupal and Magento versions
- WordPress plugins behind their latest release
- Admin logins reachable by anyone
- XML-RPC password-guessing endpoint
- HTTPS enforcement, TLS certificate and HSTS
- Security headers: CSP, frame, content-type, referrer
- Exposed
.git,.envand config backups (data leaks) - Open directory listings and readme files
- Outdated jQuery and Bootstrap with known flaws
- Firewall or CDN in front of the site
- Cookie security flags
- Insecure mixed content
- SPF and DMARC: can criminals email as you?
- Forms without bot protection
1 · Scan
Enter your address and watch every check run live.
2 · See
Your A–F grade and every finding, instantly.
3 · Unlock
Evidence and the exact fix, emailed into your private security vault.
4 · Fix
We patch, clean up and harden it within 24 hours, then keep it protected.
More than a website check.
Website security
Patching PHP and your CMS, removing vulnerable plugins, closing exposed logins and endpoints, and putting a web application firewall in front of the site.
Data security
Finding exposed configuration files, backups and listings that leak passwords and customer data, stopping email spoofing in your name, and setting up tested, off-site backups.
AI security
Hardening against automated and AI-driven attacks: bot and rate protection, no version giveaways, locked-down forms. Need AI kept private too? Private AI runs inside your own network.
The scan is free. The fix is fast.
+ $999 one-time Deep Scan & Fix. Payment plans available: 5 × $199.80.
- Deep Scan & Fix within 24 hours of access: patching, clean-up and hardening, with a written report
- Web application firewall from day one
- Weekly AI re-scans with alerts, patches within 24 hours of release
- Daily off-site backups and a monthly report for you or your insurer
Site too old to patch? We quote a secure rebuild on a modern stack with no PHP to exploit.
Questions
What is PHP2Shell?
Two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026 and rated 9.2 out of 10. Any PHP site not updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 can be attacked without a password. PHP 8.1 and older will not be fixed.
Is the free scan safe?
Yes. It only reads what your website already shows every visitor. It never logs in, never attempts an exploit and never changes anything. The paid Deep Scan goes further, and only with your written authorization.
How much does it cost to fix?
Feli-Scan Protect is $99 per month plus a one-time $999 Deep Scan & Fix (or 5 monthly payments of $199.80). Sites needing substantial rework are quoted before any extra work.
Do you cover data security and AI security?
Yes. The scan finds files and settings that leak data, checks whether your email can be spoofed, and the fix hardens your site against automated and AI-driven attacks. For keeping your own AI use private, see Private AI.
Who is behind Feli-Scan?
Felican AI, a team of certified AI professionals in Palm Beach County, Florida, working with businesses nationwide. Call (561) 264-7166 or email ai@felican.ai.