Terms of service

These terms cover the php2shell.fyi checker, the active scan and the paid PDF report. Last updated 23 October 2026.

Who we are

php2shell.fyi is run by Norminal SIA, a company registered in Latvia. It is an independent checker for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). It is not affiliated with the PHP project, the PHP2Shell researchers or Cloudflare. Contact: support@php2shell.fyi.

Using the checker

• The normal check and the active scan have no charge.
• Check only sites that you own or have permission to check. Each check asks you to confirm this.
• Run an active scan only on sites that you own or are authorized to test. Its test requests can use up PHP memory or end a PHP request on the server. What the active scan sends.
• Do not get around the rate limits or Cloudflare Turnstile, do not automate checks, and do not use the checker to attack or overload a site.
• We can block a user, a network or a site, and we can pause or stop the checker, at any time.

What a result means

• A result is an indicator from public signals, such as the PHP version that the site reports. It is not a security audit.
• A result that shows a fixed version or no signal does not prove that a site is not vulnerable. A result that shows an old version can be wrong, because some Linux distributions fix PHP and keep the old version number.
• Fixed versions and vendor statuses come from official sources and can change. We update them when the sources change. See sources and updates.

The PDF report

• The report is a PDF of one check result: the data the check gathered, steps to fix PHP2Shell on that site, commands, a message for your hosting provider, and links to the sources.
• The price is $1.99, paid once for each report. It is not a subscription. Sales tax or VAT can be added for your country, and the price can show in your local currency.
• Creem (creem.io) is the merchant of record. Creem sells the report, takes the payment, charges the tax and sends the receipt. Creem's buyer terms apply to the payment.
• After payment, the PDF downloads in the browser that started the checkout. That browser can download it again for 24 hours after the checkout started.
• The report shows the result at the time of the check. It does not update later. To see the current state of a site, check it again.
• If the download does not work, write to support@php2shell.fyi with the checkout ID or the email address you used to pay.

Refunds

You can ask for a full refund within 14 days of the purchase, for any reason. Write to support@php2shell.fyi with the checkout ID or the email address you used to pay. We send the refund through Creem to your payment method. These terms do not limit your rights under consumer law.

Commands and changes to your server

The guides and the report contain commands and configuration examples. You decide whether to use them, and you run them at your own risk. Read each command first, make a backup, and test changes on a copy of the site if you can.

Liability

• We provide the checker, the guides and the report as they are, with no warranty that they are complete, correct or always available.
• As far as the law allows, we are not liable for damage or loss from the use of the checker, the results, the guides or the report. For the report, our total liability is the amount you paid for it.
• Nothing in these terms limits liability that the law does not allow us to limit.

Privacy

What the checker stores is on the privacy section of the operators page. For a report, Creem processes your payment details and email address under Creem's privacy policy. We see the order in Creem's dashboard, and we use it only for support and refunds. The checker asks Creem only whether a checkout is paid, and does not store the answer.

Governing law

The law of Latvia applies to these terms. If you are a consumer, you also keep the protection of the mandatory consumer law of the country where you live. Disputes go to the courts of Latvia, unless consumer law lets you use the courts where you live.

Changes to these terms

We can change these terms. The date at the top shows the last change. The terms on the day of your purchase apply to that purchase.

Contact

Questions, refunds and report problems: support@php2shell.fyi. Security problems: security@php2shell.fyi.