PHP2Shell Checker
Check whether a website or a PHP version is vulnerable to PHP2Shell, the two critical PHP flaws patched on 21 October 2026. Safe and passive, free, no signup.
Safe and passive: it loads your homepage once, like a visitor, and reads the PHP version the server already shows. Nothing is attacked or probed.
Vulnerable site, or no time to patch it? I update PHP and keep websites secure.
See Maintenance PlansHow this PHP2Shell checker works
Website check: the tool loads the homepage once, the same way any visitor does, and reads the PHP version the server reports in its X-Powered-By header. It also looks for signs of WordPress, Joomla, Drupal or Laravel. It never sends attack code and never probes for the flaw, so it's safe to run on any public website.
Version check: type the PHP version from your hosting panel and the verdict appears instantly, in your browser. Nothing is sent anywhere.
Many well-run servers hide their PHP version, which is good practice. In that case the website check can't see it, and the version check is the reliable way to know.
Which PHP versions are vulnerable to PHP2Shell
The fixes for CVE-2026-109618 and CVE-2026-109619 were released on 21 October 2026. Every release below the fixed version in its branch is vulnerable:
| PHP branch | Vulnerable | Safe | Note |
|---|---|---|---|
| 8.5 | 8.5.0 to 8.5.11 | 8.5.12+ | Current release |
| 8.4 | 8.4.0 to 8.4.26 | 8.4.27+ | Recommended for most sites |
| 8.3 | 8.3.0 to 8.3.35 | 8.3.36+ | |
| 8.2 | 8.2.0 to 8.2.34 | 8.2.35+ | Support ends 31 December 2026 |
| 8.1 and older | All versions | No official fix | Move to 8.3 or 8.4 |
Ubuntu, Debian and Red Hat servers can show an older number with the fix backported, for example 8.3.6-1ubuntu1. The checker flags those so you can confirm with your host. Full details are in the PHP2Shell guide.
What to do on your kind of hosting
| Hosting | Who patches PHP | What you do |
|---|---|---|
| Hostinger shared, cloud or WordPress | Hostinger (done, per their 22 October statement) | Check hPanel uses PHP 8.2 or newer |
| Hostinger VPS | You | Update PHP packages, restart PHP-FPM |
| cPanel or other shared hosting | Your host | Ask support to confirm the fixed build is installed |
| Your own VPS or server | You | Update from your distribution, restart every PHP process |
| Docker | You | Pull the updated php image and rebuild every container |
Found a vulnerable site? I'll patch it.
I update PHP safely, check the site for signs of an attack, and keep it patched with a maintenance plan, for any host in Nepal or abroad.
Frequently asked questions
+How do I check if my website is vulnerable to PHP2Shell?
Enter your website in the checker above. If your server shows its PHP version, you get an instant verdict. If the version is hidden, find it in WordPress under Tools, Site Health, Info, Server, or in your hosting panel, then use the version check. Anything below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 in its branch is vulnerable.
+Is this PHP2Shell checker safe to run on any website?
Yes. It loads the homepage once like a normal visitor and reads public headers. It doesn't send exploit code or test the vulnerability, so it can't harm the site.
+Which PHP version is safe from PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or any newer release in those branches. PHP 8.1 and older are vulnerable and received no official fix.
+Why does the checker say my PHP version is hidden?
Your server doesn't publish its PHP version, which is a good security practice. The checker can't see it from outside, so look it up in WordPress Site Health or your hosting panel and paste it into the version check.
+My server shows PHP 8.3.6-1ubuntu1. Am I safe?
Maybe. Ubuntu and Debian often backport security fixes without changing the version number. Check that the PHP package was updated after 21 October 2026, or ask your host to confirm it includes the fix for CVE-2026-109618 and CVE-2026-109619.
+Has Hostinger patched PHP2Shell?
Hostinger says the fix is installed on all its hosting servers except VPS. Shared, cloud and WordPress hosting customers have nothing to install. VPS customers manage PHP themselves and must update it.
+Does Cloudflare protect against PHP2Shell?
Cloudflare added firewall rules for PHP2Shell that block known attack patterns, which is a useful extra layer. It isn't a fix: attackers can vary their requests, so updating PHP is still required.
What this tool does
- Check any website by its address, or a PHP version directly
- Exact verdict: patched, vulnerable, or no fix available
- Spots WordPress, Joomla, Drupal, Laravel and Cloudflare
- Flags Ubuntu and Debian builds that may carry a backported fix
- Passive: one normal page load, no attack code ever sent
How to use it
- 1Enter your website address, or switch to the version tab
- 2Read the verdict and the version you need
- 3Follow the fix for your kind of hosting
Related guides
- SecurityHow to Secure a Vibe-Coded App: The Security Checklist I Ran on My Own Site
- SecurityPHP2Shell Explained: The AI-Found PHP Flaw That Took Nepal's Government Sites Offline, and How to Fix Yours
- Web DevelopmentHow WordPress Websites Get Hacked, and the 7 Step Prevention Checklist
- Web DevelopmentWebsite Maintenance in Nepal: What It Includes, What It Costs, and What Happens If You Skip It
Want it done for you? See maintenance plans