Instant PHP check · no email
PHP2Shell check: is your server's PHP patched?
Paste your address. In a few seconds we'll read the PHP version your server shows to the world, if it shows one at all, and tell you what to ask your host about the 21 October fixes.
We only read the public headers on your homepage. Nothing to install, no email. Also: check all pages · plugin check.
How it works
One look at your public headers.
Same thing a bot sees. If your server announces a PHP version, we compare it with php.net's fixed builds. If it doesn't, we'll show you how to check yourself.
Homepage headers
We request your homepage and look at X-Powered-By and Server. That's it. No login, no paths guessed.
php.net's fixes
Fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A lower number means ask your host. Hosts often patch without changing the number.
What to do
We'll give you the exact question to send your host, plus a link to the full PHP2Shell guide and the free scan.
Questions
What is PHP2Shell?
Two critical holes in PHP, CVE-2026-109618 and CVE-2026-109619, fixed by php.net on 21 October 2026. Both can let an attacker run their own code on a server. The nickname is PHP2Shell.
Is PHP2Shell being exploited?
Yes. A working exploit has been public since 25 October 2026, and on 26 October a researcher at Perplexity caught a real break-in on a honeypot server running PHP 8.4.26. Attack traffic was still climbing that day. No mass compromise of everyday sites has been reported yet, but if your PHP build doesn't have the 21 October fixes, don't wait for one.
Which PHP versions have the fix?
php.net shipped 8.2.35, 8.3.36, 8.4.27 and 8.5.12. On 8.1 and older there is no new version number, only source patches or a vendor build. Ask your host, or move to a supported branch.
My host hides the PHP version. Can I still check?
Yes. Hiding it is fine, and common. Look at the PHP version and Build Date in your hosting panel, in WordPress under Tools → Site Health → Info → Server, or on a phpinfo page. Or ask your host whether your build has the 21 October fixes.
Does PHP2Shell affect WordPress?
WordPress runs on PHP, so every WordPress site sits on top of whatever PHP version the host is serving. The check is about that PHP version, not your WordPress version.
Want the longer version, with what the big hosts have said? Read the PHP2Shell emergency release guide. Checking plugins instead? Try the instant plugin check.