PHP2Shell Vulnerability Checker

About PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

In October 2026 the PHP project disclosed two critical core vulnerabilities, collectively nicknamed PHP2Shell. Both are rated CVSS 9.2 and allow an unauthenticated, remote attacker to execute arbitrary code — the most severe class of web vulnerability. A demonstrated exploit against Apache mod_php can trigger before your application code runs, so WordPress security plugins and application-level controls do not stop it. A public exploit was expected within days of disclosure.

The flaws are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life and receive no fix — those systems must be upgraded or retired. Because PHP powers roughly four in five websites (and almost all of WordPress), the exposure is enormous.

How this checker works

Enter your domain and select Check my site. We load your homepage once — exactly like a browser — and read the response headers (such as Server and X-Powered-By) plus a small slice of the HTML to fingerprint PHP, WordPress and whether a CDN/WAF sits in front. We then compare any disclosed PHP version against the fixed releases.

• At risk — a PHP version below the fix (or end-of-life) is being advertised.
• Unconfirmed — the site runs PHP but hides its version, so we cannot confirm from outside. Verify on the server.
• Likely OK — a fixed PHP version is advertised.

It is a passive check. We never send exploit payloads, never touch login or admin endpoints, and make no changes. Only check sites you own or are authorised to assess.

Common questions

Does this checker exploit my site?

No. It reads the public response your homepage already returns. It sends no attack traffic and alters nothing.

My site hides its PHP version — am I safe?

Hiding the version is good hardening, but it means we cannot confirm your patch level externally. On the server, run php -v (or check your package versions) and make sure you are on 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or newer, then restart the web server.

I'm behind Cloudflare — do I still need to patch?

Cloudflare shipped a managed WAF rule for this CVE, which is valuable cover — but patch the origin too. Edge rules reduce risk; a patched runtime removes it.