About the PHP2Shell check

A free service that helps site owners assess their PHP versions against CVE-2026-109618 and CVE-2026-109619, with the evidence and steps to verify the fixes on the server.

How it works

The check compares PHP versions reported by your site with the releases that fix both CVEs. When you confirm that you own the site, it sends small session-handling requests to the candidate paths, and asks for /phpinfo.php and /info.php if no version shows. It records complete responses and their URLs; incomplete session responses are not classified.

Session warnings indicate older or changed session behaviour on that path. They do not establish exploitability, a complete backport, or the separate out-of-memory fix for CVE-2026-109618. No memory-exhaustion or exploit test is run. A patched session response cannot override an older version seen elsewhere on the site. The PHP project rates Apache with mod_php as the highest risk; vendor fixes and the running PHP workers must be verified on the server.

What it cannot see

A server that hides its version and its errors gives no signal, patched or not. Distribution packages may carry the fix under an older version number. The check never reports a site as safe, only what it saw.

Which targets are checked

Public domain names and public IP addresses only, on ports 80, 443, 8080 and 8443. Private, loopback, link-local and other non-public addresses are refused, including IPv4 addresses carried inside IPv6. Each site, by scheme, host and port, is checked at most once every few minutes; a repeated request receives the earlier result. A minute after a check, Check again runs a fresh one, for example after patching.

What is recorded

One line per check: the time, the host name or address that was checked, and the verdict. Your own address is not recorded. Lines are kept for 30 days.

Recognising and allowing the check

Requests carry a User-Agent beginning with php2shell-check and a link to this page. They come from 5.75.244.113 and 2a01:4f8:c012:1000::1.

When you confirm that you own the site, the check also sends a small multipart POST to a few paths, such as the start page and /index.php. It carries a form field PHP_SESSION_UPLOAD_PROGRESS with the value probe, a one-byte upload named probe.txt, and the cookie PHPSESSID=_. The same invalid ID is also sent as a PHPSESSID form field, so the check still works behind a proxy that drops cookies. PHP's default session handler rejects the ID. A firewall rule against upload-progress requests stops this request too, and the result then says the session request was blocked.

Some firewalls and hosts refuse the check, and the result then says it was blocked or got no answer. To let it through, allow these addresses while you check, or check on the server with the commands every result lists.

Source

The service is free software under the BSD 2-Clause license. The source is at https://github.com/pawal/php2shell.