Free Tool
Is Your Website Vulnerable to PHP2Shell?
PHP2Shell refers to a class of PHP vulnerabilities (including CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on an unpatched server. This free check looks at public information about your site and tells you, in plain English, whether you should update.
- Free Check
- No Login
- Safe External Check
We only read public info -- no login, nothing changed.
What is PHP2Shell?
PHP2Shell is a shorthand for a category of PHP security flaws -- documented in PHP's own security advisories as CVE-2026-109618 and CVE-2026-109619 -- that can allow an attacker to execute commands on an unpatched server, effectively giving them a "shell" (remote command access) through a PHP weakness.
PHP fixed these issues starting with versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Any site still running an older PHP version on an affected code path may be exposed until it is updated.
Who is affected?
Online stores
Ecommerce platforms built on PHP (WooCommerce, Magento, OpenCart, custom carts) that haven't updated their server's PHP version.
Blogs & CMS sites
WordPress, Drupal, and other PHP-based content platforms running on an outdated PHP runtime at the hosting level.
Any PHP site
Custom PHP applications, internal tools, and legacy sites -- if PHP powers it and the server hasn't been patched, it's worth checking.
How does this checker work?
- 1
Connect & read public signals
We make a standard public request to your site -- the same kind a browser makes -- and read publicly visible server signals that can hint at the PHP version in use.
- 2
Compare against PHP's advisories
We compare what we found against PHP's official security advisories and supported-version list for CVE-2026-109618 / CVE-2026-109619.
- 3
Give you a plain-English report
You get a clear verdict -- Potentially Affected, Patched Version Reported, or Cannot Verify -- plus what to do next.
Frequently Asked Questions
Is this check actually safe to run on my site?
Yes. It only reads publicly available information your server already exposes to any visitor -- the same kind of request a browser makes. It does not log in, does not modify anything, and does not attempt to exploit anything.
Do I need to create an account?
No. The check is free and requires no login or signup -- just enter your website URL.
What does "Cannot Verify" mean?
It means your server didn't publicly expose a PHP version signal we could read. That is not the same as "safe" -- it just means we couldn't confirm either way, so you should check directly with your hosting provider.
What are CVE-2026-109618 and CVE-2026-109619?
They are official PHP security advisories describing vulnerabilities that can allow remote code execution on unpatched servers. PHP first shipped fixes for these in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Is this a full security audit?
No. This is a passive, public-information check focused specifically on PHP version exposure related to these CVEs. A full security audit covers far more (code review, dependency scanning, infrastructure hardening, and more) -- talk to us if you need that.
Want an expert to check this for you?
If you're not sure how to update PHP safely, or want a deeper security review, our team can help.