Use this form to look up the public website systems of your suppliers / partners to ensure your supply chain / third party risk is not vulnerable to PHP2Shell.

PHP2Shell checker

PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. On PHP installations that serve web requests, an unauthenticated attacker may be able to run code on the server. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 or later. PHP 8.1 and older are outside the PHP project's support window.

This check reads the PHP version a site advertises in its HTTP headers. It does not try to exploit the vulnerability. Compare the result with the official PHP security release.

URL

Check URL

Limitations

The checker only evaluates versions exposed in HTTP response headers or by php -v. It reads X-Powered-By and Server, sends HEAD, and falls back to GET only when HEAD returns 405 or 501. It does not follow redirects or inspect response bodies. Missing or hidden PHP headers return UNKNOWN.

OK is a version comparison based on the assumption that subsequent stable patches in each listed branch contain the fix. It does not independently verify a security fix. Check the versions against the official PHP security release. Headers can be hidden or changed, and distribution backports may not change the upstream version.

Interested in training your staff? Start training today