What is PHP2Shell?
PHP2Shell names a group of vulnerabilities in PHP’s core engine, tracked as CVE-2026-109618 and CVE-2026-109619. The issues involve memory handling after out-of-memory errors and stale internal state across requests. They can allow remote code execution without a login. See the researchers’ PHP2Shell explanation and the official PHP security advisory.
This independent PHP2Shell Checker uses the same passive checking engine as our PHP Version Checker. It helps you compare disclosed versions with the releases addressing these two CVEs. It does not send exploit payloads or verify that a vulnerability can be triggered.
How to use the PHP2Shell Checker
- Enter a website URL. Only check public websites you own or have permission to check. The website check reads the public
X-Powered-ByandServerresponse headers. - Or enter a known PHP version. Open the server-version comparison in our guide and paste the complete version or
php -voutput. This comparison runs in your browser without requesting the website. - Review the result and evidence. Keep the advertised version separate from the release comparison. Confirm the actual web runtime and complete package revision with your hosting provider before deciding whether the installation is patched.
URL checks use ordinary HTTP GET requests and follow at most three validated redirects. The response body is discarded. We do not search for exposed configuration files or hidden paths. Free website checks allow 30 requests per hour per IP address.
PHP2Shell Checker fixed-version reference
PHP published the security releases below on October 21, 2026. These are the reviewed upstream thresholds for the two PHP2Shell CVEs, rather than a list covering every PHP vulnerability.
| PHP branch | First fixed upstream release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Release data reviewed 2026-10-23. Source: PHP.net security advisory. Distributions and hosting providers may backport fixes into packages with a lower upstream version number.
How to read a PHP2Shell Checker result
- Below security release: the advertised upstream version is below its branch’s fixed release. Ask your host to update it or confirm an applicable vendor backport.
- Meets October 2026 baseline: the version number meets the reviewed threshold. This does not verify the running build, other vulnerabilities, or the website’s overall security.
- Verify vendor patch: the version has a package suffix. Verify its complete revision with the distribution or host, because upstream version numbers alone can miss backported fixes.
- Unsupported PHP branch: the branch is outside upstream support. Confirm maintained vendor coverage or plan an upgrade to a supported branch.
- Hidden, blocked, conflicting, or unavailable: there is insufficient public evidence for a reliable comparison. This does not show that PHP is absent or that the site is safe.
PHP2Shell Checker examples
These examples illustrate version comparisons, rather than findings about a real website. Suppose a response contains X-Powered-By: PHP/8.3.35. The PHP2Shell Checker compares that number with the first fixed release for the 8.3 branch, 8.3.36, and reports that it is below the security release. The next step is to confirm the package and available update with the host.
If the header instead advertises PHP/8.3.36, the number meets the reviewed baseline. You still need to verify the running installation. A header with a distribution suffix needs the vendor’s package advisory; removing that suffix and comparing only the upstream number would lose information relevant to backported fixes.
If no PHP header is present, the result stays unknown. Do not infer a version from the website’s appearance, a WordPress theme, or the age of its content. The same site can also return different headers through a CDN and directly from its application infrastructure.
Verify a PHP2Shell Checker finding on your server
Confirm the PHP runtime serving the affected website in your hosting panel or, for WordPress, under Tools → Site Health → Info → Server. A terminal’s php -v can show a different installation. Follow our guide to checking the actual PHP runtime if the public version is hidden.
Apply the appropriate PHP security update or verified vendor package, then restart the relevant PHP services and workers. Updating a CMS alone does not update the underlying PHP engine. Follow the official advisory and your provider’s instructions for your environment.
After the update, confirm the running web version and package revision again. Public headers may be missing, cached, or changed by a proxy. Keep the provider’s patch confirmation alongside your inventory; a green version comparison alone is not proof of remediation.
When contacting your hosting provider, share the check time, the advertised header, and the two CVE identifiers. Ask which PHP runtime serves this specific domain, which package revision is installed, whether that revision includes both fixes, and whether the relevant workers were restarted. These questions make a PHP2Shell Checker result easier to act on without sending passwords or granting server access.
A shared hosting account may serve several domains through different PHP configurations. Check each relevant application environment, even when the domains share one control panel. Keep public-header evidence and the provider’s installed-package confirmation as separate records so another administrator can understand how the conclusion was reached.
PHP2Shell Checker FAQ
Can the PHP2Shell Checker confirm that my website is vulnerable?
It can compare a disclosed PHP version with the fixed-release table and show the header evidence. It cannot establish exploitability, inspect installed patches, or see a hidden runtime. Use the result to guide verification with your host.
Is the PHP2Shell Checker free?
Single-website checks and manual version comparisons are free, with no signup. The bulk form below the free check is a paid option for multiple URLs, private reports, and CSV exports. It uses the same passive detection method.
Why does the PHP2Shell Checker return no version?
Many servers hide PHP headers, and a CDN or firewall may change the response. A hidden version leaves the patch status unknown. Check the web runtime through your hosting panel or use the server-check guide above.
Can I check WordPress, Drupal, or Joomla websites?
You can submit their public URLs, but a version is detected only if the response exposes it. The application name does not establish the PHP version. For WordPress, Site Health can help you confirm the web runtime when you have administrator access.
Does this test whether a website has already been compromised?
No. The tool reads public version headers; it does not inspect files, server logs, or compromise indicators. A version check cannot determine whether an earlier attack succeeded.
Use the PHP2Shell Checker for a website portfolio
Use the paid bulk checker to paste or import up to 100 URLs per batch, filter results, and export the version and header evidence as CSV. Hidden, blocked, and unreachable results count as attempted checks. Reports remain available for 30 days; unused prepaid checks do not expire.
For a team handoff, group results into updates to investigate and installations requiring more evidence. Give each website an owner who can confirm the hosting environment. Download the report before it expires, record your follow-up outside the tool, and run another check after changes. A PHP2Shell Checker inventory helps organize this work; it does not replace the host’s confirmation or an investigation of suspected compromise.
For everyday PHP version and support checks, return to the free PHP Version Checker.