- Home
- PHP2Shell check
Is your website hit by PHP2Shell?
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) let an attacker take over a server without a password. They have been exploited since 21 October 2026. Enter your website: we read the PHP version it discloses and compare it with the fixed releases.
Passive check: a single visit of the home page, like a browser. No exploitation attempt.
PHP2Shell is only one flaw among many
This check looks at one thing only: the PHP version disclosed. Our audits go further and tell you what to fix, in order.
Non-destructive penetration test
Identifies the real technology even when the version is hidden, then tests the known flaws of your site.
5 KreditsCode analysis
Finds the vulnerable dependencies of your PHP application (Composer, WordPress, plugins), without uploading the code.
1 to 3 KreditsSurface and SSL/TLS audit
Certificate, protocols, headers and exposed public information, with a grade from A+ to F.
FreePHP2Shell in short
PHP2Shell is the name of two PHP core flaws disclosed on 20 October 2026: CVE-2026-109619 (use-after-free in the upload progress feature) and CVE-2026-109618 (memory corruption on an out-of-memory condition).
They allow remote code execution without authentication, with the web server’s privileges. WordPress, Drupal, Joomla, PrestaShop and any PHP website are exposed if PHP is not patched.
Apache with mod_php is the riskiest setup; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are affected too.
Fixed releases published on 21 October 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Branches 8.1, 8.0 and 7.4 only get source patches; older ones will get none.
How to protect your site
- 1
Update PHP
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later), then restart Apache or PHP-FPM. On shared hosting, pick the latest version in the panel (Plesk, cPanel…).
- 2
Meanwhile: turn off upload progress
Partial mitigation, not a replacement for the update.
session.upload_progress.enabled = 0 - 3
Hide the version
Once patched, stop handing the version to the bots looking for vulnerable sites.
expose_php = Off
Frequently asked questions
Is the check really free?
Yes, no account and no limit other than a reasonable number of checks per quarter of an hour.
Can the check break my website?
No. We make a single visit of the home page and read the headers, like a browser. Nothing is sent to exploit the flaw.
My site hides its PHP version, am I safe?
No, hiding the version fixes nothing: attackers try the flaw blindly. Check the version in your hosting panel or with php -v on the web server.
Does my hosting provider take care of it?
Shared hosts usually update PHP, but you often have to select the new version yourself. On a dedicated server or a VPS, it is up to you.