PHP2Shell checker: is your site’s PHP vulnerable?
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers take over a server through PHP itself. Enter your website to see which PHP version your server shows and whether it has the fix. Works for WordPress and any other PHP site.
Free · no sign-up · no attack traffic, we only read what your server tells every visitor
Checking your site… this takes up to 30 seconds.
Fixed versions
Which PHP versions are safe?
| Your PHP branch | Fixed in |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
| PHP 8.1 and older | No normal update: move to 8.2 or newer |
Version hidden?
Check your PHP version in 30 seconds
In WordPress
Go to Tools → Site Health → Info, open Server and read PHP version.
In your hosting panel
Look for PHP version, Select PHP Version or MultiPHP Manager in cPanel, Plesk or your host’s dashboard.
With the free plugin
Moatline Malware Scanner 1.2.2 and newer warns you when your PHP version is open to PHP2Shell or past its end of life.
Questions
About PHP2Shell and this check
What is PHP2Shell?
PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP itself. They let an attacker run their own code on the server with a single web request, without logging in. Because the flaw is in PHP, it affects WordPress and any other PHP website, whatever plugins it uses. PHP released fixes on 21 October 2026.
How does this checker work?
Many servers announce their PHP version in a response header (
X-Powered-By or Server) sent to every visitor. We load your home page like a normal visitor, read that header and compare the version with the fixed releases. We don’t send any attack or test request to your server.It says my PHP version is hidden. Am I safe?
We can’t tell. Hiding the version is good practice, but it doesn’t fix anything. In WordPress, open Tools → Site Health → Info → Server to see your PHP version, or install the free Moatline plugin, which checks it for you. Otherwise look in your hosting control panel or ask your host.
My host says it is patched, but the version number is old. Who is right?
Probably your host. Ubuntu, Debian, Red Hat, CloudLinux and similar systems often add the fix to their own PHP packages without changing the main version number. If your host confirms PHP2Shell is patched, you’re fine.
I updated PHP. Is my site safe now?
Updating closes the hole, but it doesn’t remove anything an attacker added before. Attacks began on 17 October 2026, before the fix was out. If your site ran an unpatched version since then, check it for backdoors and unknown admin accounts.
I still run PHP 8.1 or older. What should I do?
PHP 8.1 and older no longer get normal updates. Ask your host to move the site to PHP 8.2 or newer (8.2.35, 8.3.36, 8.4.27 or 8.5.12 and later). Check that your plugins and theme support the new version first, or test on a staging copy.