CRITICAL VULNERABILITY CHECK
Know what your
website exposes.
Check your website for PHP2Shell exposure indicators.
A simple HTTP request. Clear evidence. Actionable next steps.
PHP2Shell CRITICAL
CVE-2026-109618 · CVE-2026-109619
How it works
We request the supplied page and read PHP versions advertised in response headers. We do not sign in, run exploits, or read the response body.
What the result means
A version match is an exposure indicator. Hidden versions, vendor backports and proxy behavior require verification on the host.
Update the runtime. Verify the fix.
Fixed releases: 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
Install the appropriate vendor update, restart all PHP workers, and verify the version serving web requests.
Official PHP advisory ↗