Free tool · Runs only in your browser

PHP2Shell Checker: Is your PHP version affected?

PHP2Shell is the name for two critical flaws in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They allow unauthenticated remote code execution, no matter which application runs on top. Fixed PHP releases came out on 21 October 2026. Type your PHP version below to see where it stands.

Free, no sign-up. The check runs as JavaScript in your browser: your input is not sent, stored or logged anywhere.

Important: this is a version-number check only

The checker only rates the version number you type in. Linux distributions such as Debian, Ubuntu and RHEL often backport security fixes without changing the version number, so a result of "Affected" can be a false alarm on a patched distribution package. Check your vendor's or distribution's advisory. No guarantee, and not a security audit.

How to find your PHP version

  1. Command line

    Run php -v on the server. The first line shows the version. The command-line PHP can differ from the one serving your website, so also check the web server's PHP, for example with php-fpm8.3 -v on Debian or Ubuntu.

  2. phpinfo()

    Upload a file containing <?php phpinfo(); to your web root, open it in the browser and read the version at the top. Delete the file right afterwards: it shows server details to anyone who finds it.

  3. Hosting control panel

    In cPanel, Plesk or your host's dashboard, the PHP settings for each domain show the active PHP version.

  4. WordPress

    In the WordPress admin go to Tools, then Site Health, then the Info tab, and open the Server section. It lists the PHP version.

What to do now

  1. Update PHP

    Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the patched package from your Linux distribution. Distributions and LTS vendors received the patches in advance.

  2. Restart PHP-FPM and Apache

    Old workers keep running the old code until they are restarted, for example sudo systemctl restart php8.3-fpm or sudo systemctl restart apache2. Then check the version again.

  3. Check vendor advisories

    Read your distribution's or hosting provider's advisory, and check products and appliances that bundle their own PHP.

  4. On PHP 8.1 or older

    Upgrade to a supported branch, or get a backported fix from your distribution or LTS vendor. The PHP project does not ship official releases for these branches.

  5. WAF rules are temporary only

    Web application firewall rules (for example from Cloudflare) and the configuration workarounds published by the PHP team reduce some attack paths, but do not make an installation safe. Only the update fully fixes the flaws. If you cannot patch quickly, CERT-EU and the NCSC advise considering isolating internet-facing systems or taking them offline until the fix is applied.

Sources

Last updated: 21 October 2026, based on the sources above.

Built by Dominik Ernst and Max of softbros UG (haftungsbeschränkt), a small software studio from Germany. We made this checker as a free quick help after the PHP2Shell disclosure. More about us at softbros.de.