“Your PHP version is open to PHP2Shell”
Your server announces a PHP version older than the fixed release in its line. Unless your host copied the fix in without changing the number, the site can be taken over. Ask your host today, or ask us.
Free PHP2Shell check
Is your website open to PHP2Shell?
PHP2Shell lets attackers take over a website without logging in, and attacks started before the fix came out. Scan your site to see whether its PHP version is one of the exposed ones, plus everything else a stranger can see, explained in plain English. Free, no signup.
We visit the site like any browser would and read what it sends back. We keep a log of the site and its result, never your IP address.
Reading your site…
What the result means
“Will never get the fix”
PHP 8.1 and older are past their end of life, so there is no official fix. Some hosts patched them anyway. Moving the site to a supported PHP version is the lasting answer, and the step most often put off because a plugin might break.
“We could not see your PHP version”
Your server hides it, which is good practice, so nobody outside can tell. It is not a clean bill of health. Ask your host which version runs your site and when they applied the fix.
Read the full story in PHP2Shell: what the PHP flaw means for your website.
PHP2Shell questions
What is PHP2Shell?
Two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and made public on 21 October 2026. They let an attacker run their own code on a web server without logging in. PHP runs WordPress, WooCommerce, Joomla, Drupal, Magento, Moodle and most small business websites.
How does this checker know if my site is exposed?
Many servers announce their PHP version with every page. We read it and compare it with the first fixed release in each line: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We do not attack your server to test the flaw itself, because no honest outside tool can. OpenAI’s own PHP2Shell checker works the same way.
It says it could not see my PHP version. Am I safe?
Not necessarily. Most well-run servers hide their version, which is good practice, but it means nobody outside can tell. Ask your host which PHP version your site runs and whether it has the fix from 21 October 2026. A good host answers with a version number.
It says my version is exposed, but my host says it is patched. Who is right?
Possibly both. Some hosts, including cPanel for PHP 7.4, 8.0 and 8.1, copied the fix into their own builds without changing the version number. Ask your host for the date they applied the fix for CVE-2026-109618. If they cannot give one, treat the site as exposed.
Will updating WordPress or my plugins fix it?
No. The flaw is in PHP, underneath WordPress. The WordPress security team said no WordPress update was needed or planned for it. The fix is a newer PHP on the server, which your host or developer installs.
My site was patched. Could it already have been hacked?
Yes. Attack attempts were seen before the fix was released, and a patch stops new break-ins without removing anything planted earlier. Look for admin accounts you did not create, PHP files in your uploads folder, strange redirects or spam pages, or ask us to check.
Exposed, down or hacked?
We patch it, clean it and bring it back.
We move your site to a fixed PHP version without breaking it, check for anything left behind by an attacker, and bring a site that went down back online. If your site is down right now, say so first and we will look at it first.