PHP2Shell Vulnerability Check.
php.net has announced a critical PHP security release fixing two remote-code-execution flaws. Check which PHP version your site advertises and whether it falls in the affected range.
Passive check on sites you own. One GET of your public homepage, never an exploit. php.net has not yet published the exact affected and fixed versions; they come with its 21 Oct 2026, 14:00 UTC release and this check adds them then.
Why PHP2Shell Matters.
A Runtime Flaw Reaches Every App On It
PHP runs content management systems, shops, forums and custom apps. A flaw in the language runtime itself is not limited to one plugin or one product, so everything on an affected server shares the exposure.
A Fix Date Is Also A Starting Gun
php.net announced a critical security release for 21 October 2026 at 14:00 UTC, fixing two vulnerabilities rated CVSS v4.0 9.2. Once a fix ships, attackers can study what changed. At time of writing there is no confirmed exploitation, but the window to upgrade is short.
Hidden Does Not Mean Patched
Many sites switch off the PHP version banner. That hides the number from scanners, not the flaw from attackers. Check the real version on the server rather than assuming a quiet header means a safe site.
Old Branches Get No Fix
PHP 8.1 and older are end of life. No official fix will ship for them, so the only real remedy is moving to a supported branch. Distribution packages may backport fixes, so confirm with your vendor.
How The Check Works.
- 01
Enter Your Site
Type the domain, IP, or URL of a site you own. The check reaches the public homepage exactly as a browser would.
- 02
Run The Check
We make one GET request and read the PHP version the server advertises in its response headers, then compare it with the PHP2Shell fix. No exploit is ever sent.
- 03
Read The Verdict
See the version we read, whether it falls in the affected range, the CVEs in scope, and a clear next step. If the version is hidden we say so plainly.
FAQ
Common Questions.
PHP2Shell is the nickname security researchers and the press use for two PHP vulnerabilities, reported as CVE-2026-109618 and CVE-2026-109619, that can lead to remote code execution. php.net announced a critical security release fixing two vulnerabilities, both rated CVSS v4.0 9.2, for Wednesday 21 October 2026 at 14:00 UTC.
Reports describe a wide range of PHP versions as affected. At time of writing (21 October 2026) the latest releases before the fix, 8.2.34, 8.3.35, 8.4.26 and 8.5.11, are treated as unfixed, and end-of-life branches (8.1 and older) are affected with no official fix coming. The fixed versions are announced by php.net with the release, so check there for the exact numbers.
At time of writing (21 October 2026) there is no confirmed in-the-wild exploitation and no public proof of concept. That can change quickly after a fix ships, so plan the upgrade now rather than waiting for exploit news.
It makes one ordinary GET request to your public homepage (HTTPS first, HTTP if that fails) and reads the PHP version the server advertises in its response headers, such as X-Powered-By or Server. It never sends a POST, an upload or any exploit or trigger request, and it only reads what any visitor's browser receives. Only check sites you are authorised to test.
No. Many sites hide the version with expose_php = Off, and this tool cannot see a hidden version or confirm exploitability. A hidden version is not a patched version. Run php -v on the server, or ask your host, and upgrade to the fixed release for your branch.
Not always. Distribution packages (versions like 8.3.6-1ubuntu1.2) often receive backported fixes without changing the upstream version number. The tool still judges by the upstream version and flags the result as a distribution package, so confirm against your vendor's security advisory.
Upgrade to the fixed release for your branch as soon as it is available, or move off an end-of-life branch. As a reported interim mitigation (confirm against the official PHP advisory), set session.upload_progress.enabled = 0 and rate-limit multipart POST requests at the edge. Hiding the version with expose_php = Off stops advertising it but does not fix anything.
One Site Checked. See Your Whole Edge.
This tool reads one site's PHP version. The Brandefense platform inventories every internet-facing system you run, flags new CVEs as they land, and keeps watch over your external attack surface without a break.
Request A Demo