Free check for PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Is your website exposed to PHP2Shell?
Enter your website address. We look at what your site shows the public, as a web browser would, and email you a plain-English report.
Passive and free. Nothing is tested against your site, and nothing is shown until you confirm your email.
What PHP2Shell is
PHP2Shell is the nickname for two critical flaws in PHP, the language that runs about 70% of websites, including WordPress, Drupal and Joomla. Both are rated 9.2 out of 10 for severity.
An attacker who sends the right web request can run their own code on the server. No login is needed. The flaws can also leak the memory of the server's PHP processes, which may hold passwords, API keys and session tokens.
The problem is in PHP itself, not in your website's code or plugins. Updating WordPress or a plugin does not fix it. The PHP software on the server has to be updated and restarted.
The fixes were released on 21 October 2026. Attackers were already trying the flaws four days earlier, and by 22 October they were being exploited widely.
Who is affected
If your website runs on PHP and its server has not been updated since 21 October 2026, assume it is affected.
- Every PHP release since 5.4.0, which covers more than a decade of versions.
- Every common way of serving PHP to the web: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
- Highest risk: Apache with mod_php, where the published attack works before any of your website's own code runs.
- Sites built on WordPress, Drupal, Joomla, Magento or Laravel, on shared hosting, a managed host or your own server.
Sites hosted on platforms that cannot run PHP, such as Vercel, Netlify, Firebase Hosting, GitHub Pages and Cloudflare Pages, are not affected by this flaw.
Fixed versions
PHP released fixed versions for every supported branch on 21 October 2026. Your server should be on one of these, or later:
| PHP branch | Fixed in |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 7.4 to 8.1 | No official release. These versions are past end of life. The PHP security team published minimal source patches only. Upgrade if you can. |
| PHP 5.4 to 7.3 | No fix. Past end of life with no fix at all. Upgrade, or put the site behind a web application firewall or take it offline. |
Some providers, including Ubuntu and Hostinger, apply the fix without changing the version number. A site can be patched and still report an older version, so the version alone is not proof either way.
How the check works
The check is passive. It makes the same few requests a web browser would and reads what your site already shows the public.
You enter your site and confirm your email
We only show results to the person who asked, after they click the link we email them.
We look up your site and load a few public pages
Public DNS records, your home page, and one or two standard pages that every WordPress site has. No forms, no logins, no attack traffic.
We match what we see against what is known
Signs of PHP, the PHP version if your server shows it, your hosting platform and your host's published patch status.
You get a plain-English report
Clear results arrive straight away. Anything uncertain is reviewed by a person before it is sent, usually within one business day.
Our requests identify themselves honestly with this User-Agent:
SecurityReviewBot/1.0 (+https://securityreview.schoolvision.io/how-it-works)
What to do if your site is exposed
Update PHP
Move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, or your provider's patched package. On managed hosting, check your host's notice or ask them.
Restart every PHP worker
Updated software on disk does nothing until the running PHP processes are replaced. Restart Apache, PHP-FPM or LiteSpeed.
Look for signs of a break-in
PHP files changed since 17 October 2026 that you did not deploy, PHP files in upload folders, unknown admin accounts and unknown scheduled tasks.
Rotate your secrets
If the site was reachable while unpatched, change database passwords, API keys and signing keys, because the flaw can leak them from memory.
If you cannot update straight away, settings changes and firewall rules can reduce the risk for a short time. They do not make the server safe.
Questions people ask
- Is the check safe to run against my site?
- Yes. It makes a handful of ordinary page requests, the same as one visitor loading your home page. It sends no attack traffic, fills in no forms and tries no passwords.
- Can I check a site I don't own?
- Only if you have the owner's permission. You confirm this when you submit. If your email address does not match the site, a person may review the request and send a general report instead of a detailed one.
- Why do you need my email?
- So that results only go to the person who asked. Nothing about the site is shown until you click the confirmation link we send you.
- My report says the result is uncertain. What does that mean?
- Many servers hide their PHP version, and some hosts patch without changing it. When we cannot be sure from the outside, a person reviews the findings and tells you how to confirm from your hosting account.
- My host says they patched. Am I safe?
- Probably, but it is worth checking. Hostinger, for example, patched without changing the version number, so you need to check the PHP build date in your control panel. Your report explains how.
- Does a clean result mean my site is secure?
- No. It means we saw no sign of PHP2Shell exposure from the outside. It is not a full security review. If you want one, book a call.
- What does it cost?
- The check is free. If you want help fixing what we find, or a deeper review, we will talk it through on a call first.
About ServiceVision
ServiceVision builds and runs websites and software for small and mid-sized businesses. When PHP2Shell was announced we checked our clients' and partners' sites by hand and sent each one a written report.
SecurityReview turns that process into a free check anyone can use. Every report comes with an offer to talk it through with an engineer, at no cost.
Talk it through with a ServiceVision engineer. We'll go over what we found, what it means for your site and what to do next.
Book a call about your results (opens in a new tab)