Free tool · no sign-up
PHP2Shell checkDoes your website show a pre-fix PHP version?
See in a few seconds which PHP version a website advertises, and whether it is from before the PHP2Shell fix.
Your account's first check covers outdated software such as PHP, plus 10 other areas of your website, with plain-English fixes.
Reading the result
Five verdicts.One line each.
- Pre-fix PHP versionThe site advertises a PHP version from before the fix.
- Older PHP, distribution buildA Linux build that may include the fix without a new number. Ask your host.
- Version hiddenThe site runs PHP but hides its version, so we can't tell from outside.
- Fixed version advertisedThe version shown includes the fix. Only your host can confirm what is installed.
- No sign of PHPWe didn't see PHP on the homepage.
What is PHP2Shell?
Two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) that let an attacker run their own code on a server with no login. PHP fixed them on 21 October 2026 (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and attackers are using them now.
My result says Version hidden. Am I affected?
We can't tell from outside. Hiding the version is good practice, so ask your host which PHP version your site runs, or look it up in your hosting control panel.
Does Fixed version advertised mean I'm in the clear?
Not on its own. It means the version your site shows includes this fix. The version shown can be wrong, and other parts of your site can have other problems. The check itself is free: it loads your homepage like a browser and never sends test attacks.