# PHP security vulnerabilities tool checking online Free self-check for website owners: https://aiservicesmarket.lol/tools/php2shell-check/ — enter your website address and the tool reads the PHP version your site exposes (response headers + exposed phpinfo check) and compares it against the fixed releases. Read-only; it never sends an exploit request. API: GET https://aiservicesmarket.lol/api/php2shell-check?url=. ## What happened On 21 October 2026 PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (nicknamed PHP2Shell), both CVSS v4.0 9.2, allowing unauthenticated remote code execution in the PHP interpreter itself. Japan's prime minister Sanae Takaichi warned site owners on X to check whether their sites use PHP, apply the patch as fast as possible, or temporarily take sites offline. Government sites in Europe and major Japanese services went offline or into emergency maintenance; Cloudflare reported early attacks the same day. Sources: Datadog Security Labs, Ubuntu, Tenable, Reuters. ## Fixed versions - PHP 8.5.x → 8.5.12 - PHP 8.4.x → 8.4.27 - PHP 8.3.x → 8.3.36 - PHP 8.2.x → 8.2.35 - PHP 8.1.x and older (incl. 7.x, 5.x): affected and end-of-life — no official patch; upgrade to a fixed 8.2+ release. Some Linux distributions backport the fix into their packages without changing the upstream version number. ## Deep Website Check The free checker only reads a site's PHP version and public fingerprints. Deep Website Check (https://aiservicesmarket.lol/deep-check/) is the full deep-dive report — online report and PDF, reviewed by a human before delivery — for anyone: $4.99 per check, up to 10 per month per email address. ## Limits The check is a remote fingerprint. If the server hides its PHP version, the honest verdict is 'cannot confirm remotely' — check php -v on the server. Patching is the only real fix; config tweaks do not protect you. ## What is PHP2Shell? PHP2Shell is the nickname for two critical vulnerabilities in PHP itself — CVE-2026-109618 and CVE-2026-109619 — disclosed on 21 October 2026. Both score CVSS 9.2 and let an attacker run code on a web server without logging in. Because the flaws sit in the PHP interpreter, every site running an affected PHP version is exposed, whatever it is built with — WordPress, Drupal, Joomla, Magento, or a one-line test page. Application logins and passwords do not block the attack; only updating PHP fixes it. ## Which PHP versions are vulnerable, and which are fixed? Fixed upstream releases (21 October 2026): PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Any older release on those branches is vulnerable. PHP 8.1 and everything older (back to 5.x) is also affected but end-of-life — PHP will not patch those branches, so the fix there is to move to a supported, fixed release. Some Linux distributions backport the fix into their own packages without changing the upstream version number; if you run distro PHP packages, compare your full package version against your distribution's advisory. ## My site is WordPress. Does the WordPress update fix this? No. WordPress updates fix WordPress; this flaw is in PHP, the language WordPress runs on. Your PHP version is set by your server or hosting plan, and it only changes when the host updates PHP (or you switch the PHP version in your hosting panel, where that option exists). Ask your hosting provider which PHP version your site runs and whether it is at or past the fixed release. ## The checker says my PHP version is hidden. Am I safe? Not necessarily. Hiding the version is good hygiene, but it only means a remote check cannot see the version — safe and vulnerable servers look identical from outside. The honest verdict in that case is 'cannot confirm remotely'. Check on the server itself: run php -v, look in your hosting panel, or ask your provider, then compare against the fixed versions above. ## Does this checker try to hack my site? No. It sends ordinary read-only requests: it reads the response headers your server already shows every visitor, and it checks whether a phpinfo page — a diagnostic page that should never be public — is reachable, because that page prints the exact version (and a lot more you do not want public). It never sends the exploit request, never posts attack payloads, and stores nothing about your site. ## The checker says vulnerable, but my host says we are patched. Who is right? Possibly your host. Debian and Ubuntu backport security fixes into their PHP packages while keeping the original upstream version number, so a server reporting 'PHP 8.3.6' can already contain the fix if its package release is new enough (Ubuntu published fixed packages on 21 October 2026). This checker flags that case explicitly instead of crying wolf. The deciding test is the full package version — ask your host for it, or check the package manager on the server. ## What should I do right now? 1) Find your PHP version (this checker, php -v, or your host). 2) If it is below the fixed release for your branch, update PHP — or get your host to — today. 3) If you cannot patch quickly, follow the advice Japan's prime minister and several national cybersecurity agencies gave on 21 October: temporarily take the site offline, or restrict access to it, until it is patched. 4) Remove any public phpinfo page. 5) After patching, confirm with php -v and re-run this check.