Cybereinforce Threat Enforcement
Free PHP2Shell Checker
Enter a domain. We read the PHP version the site shows the world and match it against PHP's fixed releases for PHP2Shell, in seconds. Free, no signup, nothing stored.
Read our PHP2Shell analysis and indicators →One check a minute. Only the requests an ordinary browser makes; nothing that looks like the attack is sent.
How the check works
Three ordinary page requests, the same a browser or search engine makes, and a comparison against the official fix list.
Reads the PHP version
The X-Powered-By and Server headers, PHP session cookies, the headers of a missing .php page, and PHP's old logo URL that only PHP older than 5.5 answers.
Compares with the fixed releases
Checks the version against PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, flags end-of-life branches, and recognises Linux distribution builds that may carry a backported fix.
Never touches the vulnerability
No POST, no multipart body, no upload-progress field, no file or path scanning. The domain you check is not stored.
Fixed versions
PHP released the fixes on 21 October 2026. Anything older on these branches is affected.
| Branch | Fixed in | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Patched upstream |
| PHP 8.4 | 8.4.27 | Patched upstream |
| PHP 8.3 | 8.3.36 | Patched upstream |
| PHP 8.2 | 8.2.35 | Patched upstream |
| PHP 8.1 and older | none | End of life. Upgrade, or use a backport from your OS or hosting vendor. |
Stopgaps until you can patch
From PHP's advisory. These reduce exposure; updating and restarting PHP is the only complete fix. Set them in php.ini or the FPM pool (php_admin_value), then restart every worker.
; CVE-2026-109619: block the confirmed session path session.upload_progress.enabled = 0 ; CVE-2026-109618: remove the attacker-controllable memory limit memory_limit = -1 post_max_size = 8M ; 32M if uploads are needed, keep upload_max_filesize below it ; PHP 8.5 only fatal_error_backtraces = 0
Questions
What is PHP2Shell?
PHP2Shell is the public name for CVE-2026-109618 and CVE-2026-109619, two flaws in PHP itself, each rated CVSS v4.0 9.2. One crafted request, with no login, can lead to code execution on the web server or leak secrets from its memory. Every PHP install that serves web requests is affected until it is updated: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
What does "distribution build" mean?
Debian, Ubuntu and other distributions fix security bugs inside their own packages and keep the old version number, adding a suffix such as -1+deb12u3 or -1ubuntu2.20. Such a server can be fixed even though the number looks old. Check your package changelog, for example apt changelog php8.2, or your distribution's security tracker for CVE-2026-109618.
Why does it say the version is hidden?
That is good practice: the server does not advertise its PHP version (expose_php = Off). It also means the version has to be checked on the server itself. Run php -v, or better, check PHP_VERSION from a page served by the web server, since the command line and the web server often use different PHP builds.
The checker says patched. Am I done?
Make sure every server behind the name runs the fixed version, including load balancer pools and containers, and that PHP-FPM or Apache was restarted after the update. A patched file on disk does nothing while the old code is still in memory. Then hunt for signs of earlier attempts: they started on 17 October, before the patch.
Is it OK to check a site I do not own?
The checker makes only the requests any visitor's browser makes and never attempts the vulnerability. Use it for your own sites and the sites of the organisations you support.
More free tools for the community
We publish free checkers and threat intelligence when a major threat breaks. Cybereinforce itself blocks phishing and malicious sites in the browser for Microsoft Defender environments.
All community tools PHP2Shell analysis Start Free Trial