Is your PHP affected by PHP2Shell (CVE-2026-109618)?
Enter your site's domain to run a free, read-only check for this vulnerability. We send a few ordinary HTTP GET requests to your homepage and a handful of well-known paths — no attack traffic, no exploitation attempts.
Affected versions
| PHP 8.1 | 8.1.0 – 8.1.33 |
|---|---|
| PHP 8.2 | 8.2.0 – 8.2.29 |
| PHP 8.3 | 8.3.0 – 8.3.24 |
| PHP 8.4 | 8.4.0 – 8.4.12 |
| PHP 8.5 | 8.5.0 – 8.5.1 |
Checked at: 2026-10-22 (data)
How this check works
- We send a small number of ordinary HTTP GET requests — the same kind a browser sends when visiting your site.
- We never send exploit payloads or attack traffic. The check only reads publicly visible version headers and pages.
- Check results are cached for 10 minutes and are not stored in a database. Your query is not associated with your identity.
FAQ
What is CVE-2026-109618 (PHP2Shell)?
CVE-2026-109618 (tracked together with CVE-2026-109619) is a critical PHP vulnerability disclosed in October 2026. It is exploitable when a vulnerable PHP build handles attacker-influenced input, so the primary defence is running a patched PHP version. The flaw is listed in the CISA Known Exploited Vulnerabilities catalog.
Is my PHP version vulnerable to CVE-2026-109618?
PHP branches 8.1 through 8.5 below the fixed releases are affected (see the affected-versions table above for the exact ranges per branch). If your site exposes its PHP version via the X-Powered-By header, this checker reads it and compares it against the affected ranges instantly.
How does this checker test my site?
We send a small number of ordinary HTTP GET requests — the same kind a browser sends — and read publicly visible version signals: the X-Powered-By and Server response headers, the homepage body, and PHP's public credits page if expose_php is on. We never send exploit payloads or attempt to trigger the flaw.
Why did I get an “Inconclusive” result?
The most common reasons: your site sits behind a CDN (version headers may reflect the CDN, not your origin), a WAF or bot protection blocked the probe, or PHP is installed but its version could not be determined. In every case the result page tells you exactly which signals we saw and what to check on the server.
Does “Not detected” mean my PHP is safe?
No. “Not detected” means our probes found no version signals — for example when expose_php is off and no PHP paths are exposed. Many sites run PHP invisibly to HTTP probes. Confirm your PHP version on the server (php -v or your hosting panel) before concluding anything.
How do I fix CVE-2026-109618?
Update PHP to the fixed release for your branch (see the affected-versions table). For Docker images, pull the refreshed base image; for shared hosting, ask your provider to upgrade; for self-managed servers, use your distribution's package manager or a trusted PHP repository.