PHP2Shell Checker
Check the PHP version exposed by your website against the officially fixed releases for two critical PHP2Shell vulnerabilities. The check is passive and never attempts exploitation.
PHP exposure scanner
Header, cookie and controlled 404 fingerprinting
How it works
Useful evidence without running an exploit
Fingerprint
Reads limited response headers, PHP session-cookie names and a controlled not-found response.
Compare
Matches reliable version evidence against verified PHP security advisories and fixed releases.
Stay passive
Never uploads a payload, attempts RCE, discovers files or writes anything to the target.
Frequently asked questions
CVE-2026-109618 and CVE-2026-109619 are critical PHP vulnerabilities that can allow unauthenticated remote code execution. PHP states that web-serving installations are at risk and that updating is the only complete mitigation.
It reads response headers, a PHP session-cookie name and one controlled not-found response. It does not upload a payload, attempt remote code execution, discover files or write anything to the target.
Official fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older are upstream end-of-life, so they get no official fix. Vendor backports must be checked separately.
The signal is the public response detail the version was read from, such as the X-Powered-By header. It is evidence of a version, not proof that the vulnerability was exploited.
Many servers hide the PHP version. A hidden version is not proof that the site is safe. Check the version on the server itself, for example with php -v.
No. This is a version assessment. Distribution backports and the real PHP build serving the site still have to be verified on the server.