PHP2Shell · CVSS 9.2 · checked 26 October 2026
PHP2Shell vulnerability check for techcrunch.com
techcrunch.com runs PHP but does not disclose which version, so PHP2Shell exposure cannot be ruled out from outside. Only a check from inside the server settles it. Observed on 26 October 2026.
PHP detected, version hidden
Your server is running PHP but does not disclose the version. That is good hygiene, but it also means exposure cannot be ruled out from the outside.
- PHP version
- not disclosed
- Safe at
- —
- Severity
- CVSS 9.2
The full report for techcrunch.com
The verdict above is public. The report itself is not — it contains the specifics we would rather not put on an indexed page:
- The exact signals we observed, and what they do and do not prove
- Whether your hosting provider has already backported the fix
- The remediation order that avoids an outage, as a checklist
Unlock the full report
Name and work email, and we’ll send the report and the first fix to make. It takes one business day, and there is no list to join.
What to do next
- 1
Confirm the PHP version from inside the server
php -v, or the PHP selector in the hosting control panel.
- 2
Compare it with the fixed releases
8.2.35 · 8.3.36 · 8.4.27 · 8.5.12.
- 3
Keep hiding the version — but verify exposure internally
Hiding it is good hygiene. It is not a fix.
What is PHP2Shell?
PHP2Shell is the public name for two memory-safety vulnerabilities in the core PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619, and fixed by the PHP project on 21 October 2026. Both allow an unauthenticated attacker to execute code on a vulnerable server, or to read other visitors’ passwords, session tokens and API keys out of PHP process memory. Amazon Threat Intelligence saw exploitation attempts four days before the disclosure.
The defect sits in PHP itself, so updating WordPress, Drupal, Joomla or any framework does nothing. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 8.1 and older will never be patched.
Frequently asked questions
Is techcrunch.com vulnerable to PHP2Shell?
techcrunch.com runs PHP but does not disclose which version, so PHP2Shell exposure cannot be ruled out from outside. Only a check from inside the server settles it. Observed on 26 October 2026.
How was techcrunch.com checked for PHP2Shell?
We fetched the public homepage of techcrunch.com once and read its HTTP response headers and markup — the same thing a visitor's browser does. No exploit was attempted, no payload was sent, and no port was scanned. Where a header was hidden, we say so rather than guess.
Does updating WordPress or Drupal fix PHP2Shell on techcrunch.com?
No. The flaw is in the PHP runtime itself, not in the application on top of it. Patching WordPress, Drupal, Joomla or any plugin leaves the vulnerability in place; the PHP build has to be upgraded to the fixed release for its branch.
Why might techcrunch.com show a different result on an internal scan?
This page reflects what a public request saw. A CDN, a reverse proxy or a different build behind a firewall can answer differently from the origin that serves production traffic. Treat this as a triage signal and confirm from inside the server.
Check your own domain
This page is one public result. Run the same check against your own domain in about ten seconds — no exploit, no payloads, no personal data kept.