Free tool · Security
PHP2Shell Vulnerability Checker
The PHP2Shell vulnerability checker compares your website’s public PHP version with the fixes for CVE-2026-109618 and CVE-2026-109619. If your host hides the version, use the manual check with the version shown in WordPress Site Health.
Free PHP2Shell version check
Already know your PHP version? Check it here
Free to use without an account. Read your version assessment here.
What the tool covers
Check whether your PHP version needs attention
A public version clue or a version you enter is compared with PHP’s fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Advisory checked on 21 October 2026.
Public PHP version
The existing PHP scanner reads the version disclosed by the website. Hidden or incomplete versions remain unverified.
Both PHP2Shell CVEs
The comparison uses the upstream releases that fix CVE-2026-109618 and CVE-2026-109619 together.
Hosting panel version
Enter a complete version such as 8.4.27 when the public website does not disclose it. Use the PHP runtime serving your website.
Vendor patch limits
A hosting provider can apply security fixes without changing the upstream version. Ask for confirmation that both CVEs are patched.
Understand the limits
This is a version assessment, not an exploit test or proof that your server is safe. Headers can be stale or changed. Vendor backports, private server settings and previous compromise cannot be verified here. An unknown result does not establish safety.
Understanding your result
Read the version result with your host
A version clue gives you a starting point. Confirm the active web runtime and patch status before treating the website as protected.
Affected upstream version
The version predates the fixes. Ask your host to update PHP immediately or provide evidence of a vendor patch covering both CVEs.
Fixed upstream release
The supplied version meets the fixed release for its PHP branch. Confirm that all web workers and containers actually run that patched build. This does not check for earlier compromise.
Not verified
Missing, incomplete, vendor-suffixed or unrecognised versions cannot establish patch status. Check WordPress Tools > Site Health > Info > Server, then ask your host to confirm the exact package and both security fixes.
PHP is updated by your hosting provider
PHP runs WordPress on your server. Updating WordPress, a theme or a security plugin does not update PHP itself. Give your host both CVE numbers and ask them to confirm that the patched runtime is active for this website.
Use the release for your PHP branch
The fixed releases published on 21 October 2026 are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer receive upstream security updates. A distribution or long-term support vendor must confirm any backported fix, or your host must move the site to a supported branch.
A firewall does not confirm a patch
Firewall protection and temporary configuration changes do not prove that the PHP runtime is patched. PHP’s advisory says that temporary measures cover particular attack paths and are not a complete fix. Follow the official advisory with your hosting provider.
Questions about this tool
What is PHP2Shell?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities disclosed on 21 October 2026. They can allow an attacker to run code on an affected server without signing in.
Does this checker try to exploit my website?
No. The URL check reads public PHP version evidence through the existing PHP scanner. The manual comparison runs in your browser. Neither check sends exploit payloads.
Which PHP versions contain the fixes?
PHP lists 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as fixed releases. Later stable patch releases in those same branches meet the version threshold. Vendor packages require confirmation from the vendor.
What if my PHP version is hidden or has a vendor suffix?
The result remains unverified. Read the PHP version under WordPress Tools > Site Health > Info > Server and ask your host whether its exact installed package includes fixes for both CVEs. Do not publish a phpinfo page to expose server details.
Does a fixed version mean my website is secure?
No. A version comparison cannot verify the running build, every web worker or previous compromise. Confirm the patch with your host and investigate any signs of unauthorised access separately.
Free website widget
Add this tool to your website
Let visitors use the PHP2Shell Vulnerability Checker on your own page. Copy the code into an Elementor HTML widget or a WordPress Custom HTML block, then preview the published page.
Get the embed code
The widget fits the width of its container. Increase the height value if you want more of the report visible at once; longer results can be scrolled inside the widget.
BugShield hosts and runs the tool. Results and email addresses stay inside the widget and are not shared with the page embedding it. If your editor removes the code or your site blocks external widgets, ask your website administrator to allow frames from bugshield.co.uk.
Need help with the next step?
A BugShield developer can review the findings and help you decide what your WordPress site needs.
Explore WordPress support