PHP2Shell Exposure Checker
Find out whether a website may be exposed to PHP2Shell (CVE-2026-109618 / CVE-2026-109619), and what to do about it.
Safe to use on any site: we load the page once, like a normal visitor, and read what it shows. No attack traffic is sent.
Which PHP versions are fixed?
| PHP | Status |
|---|---|
| 8.5 | Fixed in 8.5.12 and newer |
| 8.4 | Fixed in 8.4.27 and newer |
| 8.3 | Fixed in 8.3.36 and newer |
| 8.2 | Fixed in 8.2.35 and newer |
| Older than 8.2 | End-of-life: no fix, upgrade PHP |
Linux distributions (Ubuntu, Debian, Red Hat and others) sometimes backport the fix without changing the version number, so an older-looking version may still be patched. Ask your host if unsure.
What is PHP2Shell?
PHP2Shell is the name for two security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the programming language behind WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel and millions of custom websites.
The flaws are in PHP itself, not in a plugin, theme or app. That means updating WordPress or your plugins won't fix them: the PHP version on your server has to be updated. The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP older than 8.2 is end-of-life and won't get a fix.
Who is affected?
- Any website running PHP older than the fixed versions above, whatever it's built with.
- Sites on PHP 8.1, 8.0, 7.x or older. These versions no longer get security fixes at all, so they stay exposed until you upgrade.
- Online stores on WooCommerce, Magento, PrestaShop or OpenCart need extra attention, because they handle customer accounts and payments.
Sites that don't run PHP, such as static sites or apps built with Node.js, Python or Ruby, aren't affected. Hosted builders like Shopify, Wix and Squarespace manage their own servers, so there's nothing for you to update there.
How this checker works
- Loads your page like a visitor would. One normal request for the page you enter, plus WordPress's public /wp-json/ page when the site runs WordPress.
- Reads the PHP version, if the server shows it. Many servers announce it in the X-Powered-By or Server response headers.
- Looks for signs of the platform: WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, PrestaShop, OpenCart, TYPO3, Craft CMS, MediaWiki, Moodle and other PHP software, or PHP in general.
- Checks for Cloudflare, which changes what the result means for you.
- Compares what it found with the fixed versions and gives you a plain-language result with next steps.
It never sends attack code or tries the vulnerability. A check is the same as someone opening your homepage in a browser.
What your result means
At risk: update PHP now
Your site shows a PHP version that is affected or end-of-life. Update PHP as soon as you can.
Likely safe: confirm with your host
Your site shows a fixed PHP version. Double-check with your host, because headers can be out of date.
Can't confirm
Your site runs PHP but hides the version, or we couldn't read the page. Follow the steps shown to find the version yourself.
Likely not affected
We found no sign of PHP. If you know your site uses PHP somewhere, check the version on the server.
Couldn't check this site
The site didn't load for us. Check the address, or find your PHP version manually.
How to update PHP
Updating PHP is usually a setting, not a code change. Where to find it depends on your hosting:
- cPanel: open MultiPHP Manager (or Select PHP Version), choose your site and pick a newer version.
- Plesk: go to Websites & Domains, open PHP Settings for your domain and change the PHP version.
- Managed WordPress hosting: look for "PHP version" or "PHP engine" in your site's dashboard, or ask support.
- Your own server (VPS): install the updated PHP packages with your package manager, then restart PHP-FPM or your web server.
Before and after you switch:
- Back up your site and database.
- Moving up a whole version (say 7.4 to 8.5)? Try it on a staging copy first and update your plugins and themes.
- Afterwards, open a few key pages (and the checkout, for stores) to make sure everything works, then run this check again.