PHP2Shell.fyi Check a site

Is your PHP patched yet?

Header lines a server sends, and what each one means for PHP2Shell

  1. GET https://shop.example/

    X-Powered-By:PHP/8.3.12

    Not fixed PHP 8.3 is fixed in 8.3.36.

  2. GET https://blog.example/

    X-Powered-By:PHP/8.4.27

    Fixed release The header reports a fixed release.

  3. GET https://forum.example/

    X-Powered-By:PHP/8.3.6

    Check the package Ubuntu 24.04 ships a fixed build with this number: 8.3.6-0ubuntu0.24.04.13.

  4. GET https://store.example/

    X-Powered-By:(not sent)

    Cannot tell Version hidden. That proves nothing. Ask your host.

PHP2Shell is two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), fixed on 21 October 2026. Enter your site and we read what it tells the public. One ordinary request. No attack traffic.

HTTPS only. No port, login, query or #fragment.

Active scan (optional)

The check above only reads what your site shows the public. An active scan goes further: our scanner sends test requests that try to trigger the flaw. They can use up PHP memory or end a PHP request on your server.

Run it only on a site you own or are authorized to test. One press runs the normal check first, then the active scan. The human check may ask you once more in between. Each site can have one active scan every 10 minutes, and it can take up to 35 seconds.

A sample page of the detailed PDF report: the verdict, the PHP versions found and the first steps to fix them.

The detailed report

A PDF of this result for you, your hosting provider and whoever fixes the server. It includes:

  • All the data this check gathered: PHP versions, the X-Powered-By header, the final URL, timings and every signal.
  • Instructions and suggestions to fix PHP2Shell on this site.
  • Links to resources: the fixed PHP releases, the research and our guides.
  • Scripts and commands to find the real PHP version, update it and check again.
  • Instructions for your hosting provider and your webmaster, with a message ready to send.
  • Instructions for automated AI agents to detect and fix these issues, with a prompt to paste.

The report costs $1.99.

After payment, the PDF downloads in this browser.

Know your version? Type it.

Or try one of these:

Nothing leaves your browser. It uses the same rules as the site checker, dated 22 October 2026.

Not fixed

PHP 8.3 is fixed in 8.3.36.

Install 8.3.36 or a later 8.3 release. Security support for PHP 8.3 ends on 31 Dec 2027.

What the check does

First,
a human check.

Turnstile and rate limits come before anything else. You can start 10 checks a minute, and each site can be checked once every 10 minutes by everyone together.

Then we look up
the address.

DNS goes through Cloudflare’s resolver. If the name points to a private or internal address, the check stops there.

Then one
ordinary request.

A normal GET for the page you entered, with at most two redirects on the same site. No payloads, no uploads, no extra paths.

Last, we read,
then forget.

We read the status, a few headers, cookie names and page markers. The page body and the website address you entered are not stored.

Before the check

Human check
Passed
Your checks
1 of 10 this minute
shop.example
Next check in 10 minutes

DNS over HTTPS, Cloudflare

shop.example A
93.184.215.14 public
shop.example AAAA
2606:2800:21f:cb07::1 public
intranet.example A
10.0.0.5 private, check stops

The request, in full

GET / HTTP/1.1
Host: shop.example
User-Agent: PHP2Shell-Exposure-Checker/2.0
  (+https://php2shell.fyi/about; passive, one GET)
Accept: text/html
Accept-Encoding: identity

What we keep from the answer

Status
200
X-Powered-By
PHP/8.3.12
Cookie names
PHPSESSID
Page markers
/wp-content/
Stored after
Nothing

Every branch has a next step

$ php -v
PHP 8.3.36 (cli) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies

$ php-fpm8.3 -v
PHP 8.3.12 (fpm-fcgi) (NTS)
The command-line PHP can differ from the web PHP. Check the one that serves your pages.
Fixed PHP releases by branch
BranchInstallNote
PHP 8.58.5.12Supported to 31 Dec 2029
PHP 8.48.4.27Supported to 31 Dec 2028
PHP 8.38.3.36Supported to 31 Dec 2027
PHP 8.28.2.35Supported to 31 Dec 2026
8.1, 8.0, 7.4No releaseAsk your vendor
7.3 and olderNo fixUpgrade
PHP 8.68.6.0RC4Not for production
Ubuntu 24.048.3.6-0ubuntu0.24.04.13php8.3 package
Ubuntu 22.048.1.2-1ubuntu2.28php8.1 package
Debian 138.4.27-1~deb13u1php8.4 package
Debian 128.2.35-1~deb12u1php8.2 package

A later release in the same branch also has the fix. PHP 8.1, 8.0 and 7.4 get source backports only, no release. Source: the php.net advisory of 21 October 2026 and the vendor trackers. Every branch and distribution: fixed versions and Linux packages.

Where to find PHP on your platform

Tools › Site Health › Info › Server shows the PHP version. Updating WordPress, plugins or themes does not change PHP. Read the WordPress guide.

cPanel: MultiPHP Manager shows the branch only, so confirm the exact build. Plesk: Websites & Domains shows the PHP version on each domain card. Read the cPanel and Plesk guide.

Drupal: Reports › Status report. Joomla: System › System Information. Both show the PHP that serves the site. Guides: Drupal and Joomla.

No admin screen shows it. php -v on the server shows the command-line PHP, and the web PHP can differ, so check your hosting panel too. Guides: Magento, Laravel and Symfony.

Moodle: Site administration › Server › PHP info. Nextcloud: Administration settings › System. WHMCS: Utilities › System › PHP Info. Guides: Moodle, Nextcloud and WHMCS.

All 15 platform guides, including MediaWiki, phpMyAdmin, Plesk, DirectAdmin and aaPanel.

Questions

All questions and answers

Does updating WordPress fix it?

No. The flaw is in PHP itself. WordPress core, plugins and themes run on PHP but do not change it. Update PHP, or ask your host to. See the WordPress guide.

My site hides its PHP version. Am I fine?

Not necessarily. Hidden is not fixed: expose_php=0 only removes the header. Ask your host which PHP build serves the site.

Is PHP-FPM behind nginx affected?

Yes. php.net names PHP-FPM as at risk, and remote code execution was shown on PHP-FPM for CVE-2026-109619.

Does a WAF or Cloudflare cover me?

It reduces the risk for traffic that passes through it. Requests sent straight to your server skip it, so lock the origin to your CDN, and update PHP anyway.

What does the checker send to my site?

One ordinary GET request, and at most two redirects on the same site. Its User-Agent names php2shell.fyi. The optional active scan sends test requests, only when someone starts it. To opt out, see what the checker sends.

Why one check per site every ten minutes?

To protect sites from repeated checks. The limit counts all users together, so someone else may have checked your site a moment ago.