Could your site be exposed to PHP2Shell?
Check the PHP version your website makes public. Find out if it needs a closer look, and what to ask your host next.
Free. No account required. No exploit payloads.
Check your website
Start with your public website address.
A public header check can flag a version to review. It cannot confirm exploitability or certify a site as safe.
Check the runtime.
Then get it updated.
PHP2Shell affects PHP itself. WordPress, Laravel and other PHP applications depend on the runtime their host provides.
These are the first upstream releases with both October 21 fixes. Install the latest supported security release available from your provider.
Read PHP’s official advisory| PHP branch | First fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
PHP 8.1 or older? Ask your vendor about a backport or move to a supported branch. Version numbers alone don’t identify backported fixes.
Check your server’s PHP version
Log in to the server hosting your website via SSH, then run this command. Compare the PHP version on the first line with the fixed releases above.
No SSH access? Check your hosting panel’s PHP settings or ask your host.
php -vThis reports command-line PHP. Your website or container may use a different PHP installation. Confirm the web version and any vendor backport with your host.
Questions about this check
A quick check is a starting point. Your host can confirm what’s actually running.
What is PHP2Shell?
PHP2Shell is the name used for two PHP remote code execution vulnerabilities disclosed in October 2026: CVE-2026-109618 and CVE-2026-109619. They affect PHP itself, so updating a CMS or a plugin alone does not replace updating PHP.
Can a URL check prove that my site is safe?
No. This check reads the PHP version advertised in public response headers. Hosts often hide that version. A CDN can cache it, a server can change it, and a distribution can backport a fix without changing the upstream version number. Confirm the installed web runtime and package with your hosting provider.
Will this try to exploit my website?
No. We send one ordinary HEAD request to the homepage. We don’t send exploit payloads, submit forms, upload files, follow redirects or download the page. Only check websites you own or have permission to assess.
Why does my result say “unknown”?
The site may hide its PHP version, return a redirect, block the request, or use a different runtime. None of those proves the server is patched. Ask your host which PHP package serves web requests and whether both October 21 fixes have been applied.
What should I ask my hosting provider?
Ask whether CVE-2026-109618 and CVE-2026-109619 are fixed on every web server and PHP worker serving your site. Ask for the package version or backport advisory and confirmation that workers were restarted. The PHP version in a terminal can differ from the one handling your website.
Keep suspicious links out of your app.
Check URLs for phishing, malware and other risk signals with the Link Shield API.