1Check your site
Enter a site you own or manage. We read its public version banner only — no scanning, no login, nothing intrusive.
Know your PHP version already? Check it directly
A version number alone isn't a guarantee — some hosts back-port the fix without changing it. For end-of-life branches the number can't confirm patch status; use the drop-in file in step 2.
2Check the server itself
If your host hides the version, the surest check runs on your own server. This small file reports the PHP version and a verdict. It contains no exploit code.
- Copy the file below and save it as
php2shell-check.php. - Upload it to your website (e.g. the site root).
- Open
https://yoursite.example/php2shell-check.php. - Delete the file afterwards.
<?php
// php2shell self-check — SAFE. Reports PHP version and verdict only. No exploit code.
// Upload to your site, open it in a browser, then DELETE it.
header('Content-Type: text/plain; charset=utf-8');
$v = PHP_VERSION;
$branch = implode('.', array_slice(explode('.', $v), 0, 2));
$fixes = ['8.2'=>'8.2.35','8.3'=>'8.3.36','8.4'=>'8.4.27','8.5'=>'8.5.12'];
echo "Site PHP version : $v\n";
echo "php2shell CVEs : CVE-2026-109618 / CVE-2026-109619\n\n";
if (isset($fixes[$branch])) {
if (version_compare($v, $fixes[$branch], '>=')) {
echo "RESULT: PATCHED — $v is at or above the fixed build ({$fixes[$branch]}).\n";
} else {
echo "RESULT: VULNERABLE — update to {$fixes[$branch]} or later.\n";
}
} elseif (version_compare($v, '8.2.0', '<')) {
echo "RESULT: END-OF-LIFE BRANCH ($v) — no official PHP fix exists for this branch.\n";
echo "Your host MAY have back-ported a fix without changing the version number,\n";
echo "so this number alone cannot confirm it. Ask your host to confirm the package\n";
echo "build date, or migrate to PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later.\n";
} else {
echo "RESULT: UNKNOWN — version $v not recognised; confirm with your host.\n";
}
What to do
- Supported PHP (8.2–8.5): update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later).
- End-of-life PHP (8.1 or older): no official fix — move to a supported version, or confirm your host has applied a back-ported patch.
- Interim only:
session.upload_progress.enabled = Offreduces exposure but does not fully fix it. Patching is the only complete fix. - Hosted elsewhere? Ask your web host to confirm in writing which PHP version you run and when the 21 October fix was applied.
This checker reads your site's public version banner and offers guidance. It does not
prove a site is secure or test for exploitation. Always confirm patch status with whoever manages your server.