Skip to content
Drishvi Technology

PHP Vulnerability Checker: Is Your Website Safe from php2shell?

On 21 October 2026 the PHP project released emergency fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (“php2shell”, CVSS v4.0 9.2). They affect PHP 5, 7 and 8. Hosting auto-updates often do not apply the fix, so check your site now.

1 visitor

Passive check: we send one normal request to this address and read the PHP version the server reports. No attack is tried, and the address isn’t saved.

How to check your PHP version yourself

If the result is “Unknown”, or you want to confirm it, look up the exact version (for example 8.3.36) on the server.

cPanel

  1. Log in to cPanel and open “Select PHP Version” in the Software section.
  2. The current PHP version is shown at the top.
  3. If it shows only two numbers (like 8.3), ask your host for the exact version, or use php -v below.

Plesk

  1. Log in to Plesk and open Websites & Domains.
  2. Under your domain, open PHP (PHP Settings).
  3. The PHP version used by the site is shown there.

SSH (command line)

  1. Connect to the server over SSH.
  2. Run the command php -v. The first line shows the version, for example “PHP 8.3.36 (cli)”.
  3. The command line can use a different PHP from the website. If the two differ, trust the version set in cPanel or Plesk.

How it works

  1. 1

    Enter your website address and press “Check my site”.

  2. 2

    We send one normal request to that address and read the X-Powered-By header, where many servers report their PHP version.

  3. 3

    The version is compared with the fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

  4. 4

    You see Patched, Vulnerable, or Unknown, with what to do next.

Frequently asked questions

What is php2shell (CVE-2026-109618 and CVE-2026-109619)?
Two critical remote code execution flaws in PHP, rated 9.2 on CVSS v4.0. The PHP project released emergency fixes on 21 October 2026. They affect PHP 5, 7 and 8.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (or newer releases of the same branch). PHP 8.1 and older get no fix from the PHP project and need an upgrade to a fixed PHP 8.2 or newer.
My hosting updates automatically. Am I safe?
Not necessarily. Hosting auto-updates often do not apply the fix. Check the exact PHP version your site uses, with this tool or with the steps above.
The result says “Unknown”. Is my site safe?
We can’t tell. Your server hides its PHP version, which is good practice, but it also means nobody can confirm from outside that it is patched. Check the version yourself with the steps above, or ask us to check it for you.
Is this check safe for my website?
Yes. It is a passive check: we send one normal request to the address you enter, the same as a visitor opening the page, and read one header. No attack or test code is sent, and no other pages are requested. The address is not saved unless you send the “Get it fixed” form.

Also searched as

A free online tool to check a website for the php2shell PHP vulnerability: no sign-up and nothing to install.

  • php2shell checker
  • CVE-2026-109618
  • CVE-2026-109619
  • check php version of website online
  • is my php version vulnerable
  • php security update check
  • php 8.1 end of life upgrade
  • website security check free

Worried about your website’s security?

We update PHP, fix vulnerable sites and keep business websites running safely.

Get a free quote Chat on WhatsApp

More free tools

Chat with Drishvi Technology on WhatsApp