On 21 October 2026, two critical vulnerabilities were disclosed in PHP, the language behind WordPress, most online shops and a large share of the web. An attacker can take over the server without any password. Check which PHP version your website advertises right now.
A result in seconds, at no cost.
Only ordinary requests, like a visitor. We send no code.
No sign-up and no personal data needed to check.
We don’t store the address you check or publish results.
Two critical vulnerabilities in the PHP engine, rated CVSS 9.2, that allow a server takeover without a password. They are already being exploited.
PHP2Shell is the name given to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 out of 10. They sit in the PHP engine itself, in how it handles memory between requests, not in your site, theme or plugins.
An attacker can run code on the server without logging in: read the database, files and passwords, or change the website. The details went public before the fixes, and the first attacks were reported on the day of disclosure.
Any site on an unpatched PHP version: WordPress, online shops, custom apps. Only these releases are fixed:
Any server running PHP for a website: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed. Apache with mod_php is the most exposed: the attack can start before a single line of your site’s code runs.
PHP 8.1 and older (including 7.4) no longer get official releases, only source-level patches and updates from some Linux distributions.
With the checker above, or in your hosting panel under “Select PHP Version”.
To 8.2.35, 8.3.36, 8.4.27 or 8.5.12. On 8.1 or older, move to 8.3 or 8.4.
Admin, database, FTP and API keys. PHP memory could have been read by an attacker.
Other sites, subdomains, old servers. Hide the version with expose_php = Off.
post_max_size and session.upload_progress.enabled=0. They reduce some attack paths but do not make an installation safe. Only updating fixes the problem.The name for the two critical PHP vulnerabilities disclosed on 21 October 2026, CVE-2026-109618 and CVE-2026-109619. Both can let an attacker run code on the server without authentication. Both are rated CVSS 9.2 out of 10.
Yes, if the server runs an unpatched PHP version. The flaw is in PHP, not in WordPress or plugins, so updating WordPress does not help. What matters is the server’s PHP version.
No. We send a single ordinary request, like a visitor would, and read only the PHP version from the response. We send nothing that tries the vulnerability.
Not necessarily. It only means the server doesn’t advertise its PHP version, which is a good setting but not a fix. Confirm the version in your hosting panel or ask your hosting provider.
Most hosting panels (cPanel, Plesk) let you pick the PHP version. Choose 8.3 or 8.4, check that the site works, and ask your host to confirm the server runs a fixed release.
The PHP project no longer ships official releases for 8.1 and older. It provided source-level patches for 7.4, 8.0 and 8.1, and some Linux distributions ship their own updates. The safe path is moving to 8.3 or 8.4.
/cpanel redirect), the web server and CDN, then look for the PHP version on the homepage and on pages typically served by PHP (/index.php, /wp-login.php). Everything is passive: ordinary requests on ports 80 and 443, like a visitor. We don’t scan other ports and send nothing that tries the vulnerability. Version classification starts from php2shell-checker (OpenAI); the detection is our own. The result is a signal, not an audit: providers can backport the fix without changing the version number.We check the PHP version directly on the server, apply the update, test that the site works and rotate any credentials that may have been exposed.
We reply within one business day with concrete next steps for your site.