PHP2Shell Checker

Use this free PHP2Shell checker to see whether your website runs a PHP version affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Enter your site address, or type the PHP version you see on your server.

PHP2Shell checker data last checked against the official advisory: October 21, 2026.

What the PHP2Shell checker tells you

PHP2Shell is a family of critical memory-safety vulnerabilities in core PHP, disclosed on October 21, 2026 with a CVSS score of 9.2. An attacker who needs no account can run code on the server or read sensitive process memory, such as passwords, session tokens, API keys and certificates. Because the bug is in the PHP engine, a site can be affected even when its own code is perfectly written. The researchers showed this with a plain "Hello World" app.

The PHP2Shell checker answers one question: is the PHP running your site older than the first fixed release? It reads what your server reveals in its headers. If the PHP version is visible, you get a direct verdict. If it is hidden, which is common, the PHP2Shell checker tells you whether the site looks like it runs PHP (WordPress, Drupal, Joomla, Laravel or a PHP session cookie) and points you to the one-minute server check.

PHP2Shell fixed versions

These are the vulnerable and first fixed releases per branch, from the official disclosure and the PHP Foundation announcement:

Distribution packages (Ubuntu, Debian, Red Hat, CloudLinux, cPanel EasyApache) often backport the fix without changing the upstream version number. If your version looks old but comes from such a package, check the package changelog for CVE-2026-109618. Commands are on the PHP2Shell patch page.

How to use the PHP2Shell checker, or check by hand

1. Find the PHP version that serves web requests. In WordPress go to Tools → Site Health → Info → Server. On a server, run php -v, but note the command-line version can differ from the one Apache or PHP-FPM uses.
2. Enter it in the PHP2Shell checker, or compare it with the table above. On the 8.3 branch, for example, 8.3.35 is vulnerable and 8.3.36 is fixed.
3. Check every runtime. Servers with cPanel, Plesk or aaPanel often have several PHP versions side by side. Each one that a site can use must be updated.
4. Restart after updating. Apache, PHP-FPM and long-running PHP workers keep the old code in memory until they restart.

Who is affected by PHP2Shell

PHP runs roughly 70% of websites, including WordPress, Drupal, Joomla, MediaWiki, Moodle, Nextcloud, Laravel and Symfony apps. The researchers demonstrated unauthenticated remote code execution on the latest WordPress, Drupal and Joomla container images, but exploitation does not require any of those applications. According to the PHP Foundation, Apache with mod_php is the most exposed setup: an unauthenticated request can trigger CVE-2026-109618 before any application code runs, with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

Run the PHP2Shell checker on every site you manage, not just the main one. Sites on managed platforms are only as safe as the PHP build the host runs. If you are on shared hosting, the fix is usually a version switch in your control panel or a ticket to support.

What to do if the PHP2Shell checker says you are vulnerable

1. Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or to a vendor package that includes the fix. This is the only complete remediation. Step-by-step commands: PHP2Shell patch guide. Then run the PHP2Shell checker again to confirm.
2. If you cannot update today, apply the temporary measures from the advisory and keep your WAF rules on. They reduce some attack paths but not all of them: PHP2Shell mitigation.
3. Look for signs of compromise on servers that were exposed, especially if they hold credentials or customer data, and rotate secrets that were in memory.

Beyond the PHP2Shell checker: fix guides

PHP2Shell checker FAQ

Short answers to what people ask most after running a PHP2Shell checker.