Is your website exposed to PHP2Shell?
PHP2Shell is a pair of critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Enter your site to see which PHP release it advertises and, with your permission, whether it behaves like a patched release.
What the check does
It fetches your start page as a browser would, plus at most two PHP pages it links to, and reads the PHP version the server advertises. That version is compared with the releases that carry the fix.
If you confirm that the site is yours, it adds one small, harmless request that shows whether the PHP serving the page carries the fix. It changes nothing on your server. The about page explains more.
What it cannot see
A hardened server advertises no version and shows no errors. Distributions such as Ubuntu and Red Hat also fix PHP without changing the version number. A result without a finding is therefore not proof of safety. Only a check on the server itself is conclusive.
If your site is flagged
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your vendor's fixed package.
- Restart every PHP worker afterwards, so the old code is no longer running.
- Follow the PHP security advisory for interim measures.