Could your site be affected?
Enter your website address to check for publicly reported PHP version information and compare it with the PHP2Shell security fixes.
What to do next
Request a callback
Want help verifying or patching your site? Leave your details and we’ll get in touch.
What this check can tell you
This is a public version check, not an exploit test or malware scan. We make a few ordinary web requests; we do not send attack payloads, upload files, or try to exhaust your server’s memory.
Headers may be missing, outdated, or supplied by a proxy. A hosting provider may also backport a fix without changing the advertised PHP version. A firewall signal does not prove that a particular protection is enabled or that the server is patched.
For a verified answer, ask your host to confirm fixes for CVE-2026-109618 and CVE-2026-109619 in the PHP runtime serving this site, including any vendor backport, and confirm that the running PHP workers were restarted.
Fixed upstream releases, checked October 21, 2026: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, or later releases within those branches. Read the PHP advisory (opens in a new tab).
Results may be cached for 10 minutes. We temporarily store the normalized public homepage URL and result, plus hashed network identifiers to limit automated abuse. Do not enter private or signed links.
