Is your site exposed to PHP2Shell?
Type your address. We read the PHP version your server announces and compare it with the patched releases. It takes a few seconds and we never attempt an attack.
Passive check only: we request your home page like a normal visitor. Free and no sign-up needed.
Why is PHP2Shell so dangerous?
PHP2Shell is the common name for two critical flaws in the PHP core (CVE-2026-109618 and CVE-2026-109619), rated 9.2 on CVSS v4.0. An attacker needs no username or password; by sending specially crafted requests they can run their own code on the server. According to reports, the attack can succeed before your site's own code even runs. So even if WordPress, your plugins or your security plugin are up to date, the risk remains if the server's PHP is not patched.
Details leaked before the planned disclosure and public exploit code is circulating. National cyber security centres have said they expect large-scale exploitation. We cover the flaw in full in our PHP2Shell article.
Safe versions
| PHP branch | Safe version |
|---|---|
| 8.5 | 8.5.12 and later |
| 8.4 | 8.4.27 and later |
| 8.3 | 8.3.36 and later |
| 8.2 | 8.2.35 and later |
| 8.1 and older, 7.x, 5.x | No official patch; move to a supported version |
What does this check look at?
The check is fully passive; it makes no attack or exploit attempt against your site. It requests your home page and two small addresses like an ordinary visitor and reads the signs in the response:
- The PHP version your server announces (X-Powered-By and Server headers). If the version is visible, we compare it with the patched releases.
- Signs that PHP is in use: session cookies, WordPress file paths, .php addresses.
- Hosted platforms (such as Shopify or Wix): in that case server updates are the provider's responsibility.
If the version is hidden, we count that as good practice, but we cannot prove from outside that the patch is applied. In that case we say "needs verification"; we do not guess and say "you are safe". Because distributions such as Ubuntu and Debian may backport the fix under the old version number, we also mark such servers as needing verification.
If the result is critical
Don't panic, but don't wait. The check shows you step by step what to do. The fastest option is to call us: +90 850 432 55 13. On systems we host and maintain we apply the update the same day; for a site hosted elsewhere we can check your server with you and draw up a plan.
If you would like to see your site's security together with privacy compliance, SEO and email reputation, our free digital analysis tool also includes the PHP2Shell check.
Frequently asked questions
Can this check harm my site?
No. We only request your public home page and two small addresses like a visitor. We do not submit forms, try to log in or test the flaw.
The result says "no PHP found". Am I safe?
It means we saw no sign of PHP on your home page. If you have an old site, admin panel, blog or campaign page on the same domain or a subdomain, have those checked too; forgotten installations are often the weakest link.
The result says "needs verification". What should I do?
Ask your hosting provider or IT team for the exact PHP version. If it is below the versions in the table above, ask for it to be updated today. If you are not sure, call us.