PHP security vulnerabilities tool checking online
On 21 October 2026, two critical holes in PHP itself — CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 — sent government websites offline across Europe and Japan. Japan’s prime minister Sanae Takaichi posted an urgent warning on X: check whether your sites run PHP, get the patch applied tonight, or take the site down until you can. This free checker reads the PHP version your site exposes and tells you where you stand.
Check your site now
Read-only check: we read your site’s public response headers and look for an exposed phpinfo page, then compare any PHP version we find against the fixed releases. We never send an exploit request, and we store nothing. Only check websites you own or have permission to test.
Deep Website Check · $4.99 · open to everyone
Want the full picture, not just the PHP version?
This free check only reads your site’s PHP version and public fingerprints. Deep Website Check is the full deep-dive: a complete report on your website — online report and PDF — covering its PHP and platform fingerprint, its full TLS certificate chain, what a real browser sees on the homepage, and its security headers, reviewed by a human before delivery. $4.99 per check, open to everyone (up to 10 a month per email).
Get a Deep Website Check — $4.99What happened
PHP’s security team announced two critical vulnerabilities on 20–21 October 2026, after details leaked ahead of the planned disclosure. Both flaws live in the PHP interpreter’s request handling, so an attacker can execute code on a vulnerable server before any application code runs — no login, no password, and it works against even a trivial test page. The pair was quickly nicknamed PHP2Shell. Fixed versions were released on 21 October; Cloudflare reported early attack attempts the same day, and the Dutch and Finnish governments, Japan’s Niconico, Pixiv and DMM, and many others took services offline or into emergency maintenance rather than wait. PHP powers roughly three quarters of websites whose server-side language can be identified — including every WordPress, Drupal, Joomla and Magento site.
Sources: Datadog Security Labs analysis, Ubuntu’s php2shell advisory, Tenable’s FAQ, and Reuters on the prime minister’s warning.
Fixed versions
Patching is the only real fix — configuration tricks circulating online (such as disabling session upload progress) do not protect you, per Datadog’s reproduction.
| Your PHP branch | Fixed release (21 Oct 2026) | Status if you are below it |
|---|---|---|
| 8.5.x | 8.5.12 | Vulnerable |
| 8.4.x | 8.4.27 | Vulnerable |
| 8.3.x | 8.3.36 | Vulnerable |
| 8.2.x | 8.2.35 | Vulnerable |
| 8.1.x and older (incl. 7.x, 5.x) | — | Vulnerable and end-of-life: no official patch will come. Upgrade to a fixed 8.2+ release (some Linux distros backport fixes into their own packages — check your package version). |
What to do now
- Find your PHP version. Run the checker above, run
php -von the server, check your hosting panel, or ask your provider. - Patch today if you are below the fixed release. On shared hosting only the provider can do this — contact them now and ask which version they will move you to.
- Can’t patch quickly? Go temporarily offline. That is the explicit advice Japan’s prime minister and several national cybersecurity agencies gave on 21 October: a short planned outage beats an open server.
- Remove any public phpinfo page (phpinfo.php, info.php). It prints your full server configuration to anyone who asks.
- Verify. After the update, confirm with
php -vand re-run this check.
What this check can — and cannot — tell you
The check is a remote fingerprint, and it is honest about its limits. If your server announces its PHP version (many do, in the X-Powered-By header) or exposes a phpinfo page, the verdict is exact. If the version is hidden, the check says so instead of guessing — a hidden version is not proof of safety, and the only certain test is on the server itself. If your version carries a Linux distribution package suffix, the check flags the backport question rather than declaring you vulnerable. A CDN in front of your site can also strip the signals; in that case, check the origin server.
Questions, answered straight
What is PHP2Shell?
PHP2Shell is the nickname for two critical vulnerabilities in PHP itself — CVE-2026-109618 and CVE-2026-109619 — disclosed on 21 October 2026. Both score CVSS 9.2 and let an attacker run code on a web server without logging in. Because the flaws sit in the PHP interpreter, every site running an affected PHP version is exposed, whatever it is built with — WordPress, Drupal, Joomla, Magento, or a one-line test page. Application logins and passwords do not block the attack; only updating PHP fixes it.
Which PHP versions are vulnerable, and which are fixed?
Fixed upstream releases (21 October 2026): PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Any older release on those branches is vulnerable. PHP 8.1 and everything older (back to 5.x) is also affected but end-of-life — PHP will not patch those branches, so the fix there is to move to a supported, fixed release. Some Linux distributions backport the fix into their own packages without changing the upstream version number; if you run distro PHP packages, compare your full package version against your distribution's advisory.
My site is WordPress. Does the WordPress update fix this?
No. WordPress updates fix WordPress; this flaw is in PHP, the language WordPress runs on. Your PHP version is set by your server or hosting plan, and it only changes when the host updates PHP (or you switch the PHP version in your hosting panel, where that option exists). Ask your hosting provider which PHP version your site runs and whether it is at or past the fixed release.
The checker says my PHP version is hidden. Am I safe?
Not necessarily. Hiding the version is good hygiene, but it only means a remote check cannot see the version — safe and vulnerable servers look identical from outside. The honest verdict in that case is 'cannot confirm remotely'. Check on the server itself: run php -v, look in your hosting panel, or ask your provider, then compare against the fixed versions above.
Does this checker try to hack my site?
No. It sends ordinary read-only requests: it reads the response headers your server already shows every visitor, and it checks whether a phpinfo page — a diagnostic page that should never be public — is reachable, because that page prints the exact version (and a lot more you do not want public). It never sends the exploit request, never posts attack payloads, and stores nothing about your site.
The checker says vulnerable, but my host says we are patched. Who is right?
Possibly your host. Debian and Ubuntu backport security fixes into their PHP packages while keeping the original upstream version number, so a server reporting 'PHP 8.3.6' can already contain the fix if its package release is new enough (Ubuntu published fixed packages on 21 October 2026). This checker flags that case explicitly instead of crying wolf. The deciding test is the full package version — ask your host for it, or check the package manager on the server.
What should I do right now?
1) Find your PHP version (this checker, php -v, or your host). 2) If it is below the fixed release for your branch, update PHP — or get your host to — today. 3) If you cannot patch quickly, follow the advice Japan's prime minister and several national cybersecurity agencies gave on 21 October: temporarily take the site offline, or restrict access to it, until it is patched. 4) Remove any public phpinfo page. 5) After patching, confirm with php -v and re-run this check.
Want your AI assistant to run the whole job?
The PHP2Shell Vulnerability Check skill runs this same check through your AI assistant, works through the version-hidden and distro-backport cases with you, writes the one-page owner report, and then walks the patch and the re-check until your site is confirmed fixed.
Get the skill — $4.99