PHP vulnerability check (php2shell)

Enter a website address and we'll check it from a North America probe: which PHP version the server reports in its response headers, and whether that version is affected by php2shell (CVE-2026-109618 and CVE-2026-109619).

Each check runs a one-time public diagnostic from our network and is viewable at its own link, so don't submit anything confidential. You can request removal of a check from our tools.

What is php2shell?

php2shell is the name for two critical remote code execution bugs in PHP. CVE-2026-109618 is triggered through a multipart upload, and CVE-2026-109619 through reused memory. Both are fixed in current PHP releases.

This check reads the PHP version your server reports in its response headers and compares it with the fixed release for that version's branch. A server can hide or change that header, so treat the result as an indication and confirm on the server.