Is yourwebsiteaffected byPHP2Shell?
Enter your website address. We load your page once, like a browser would, and tell you in plain language whether it runs PHP, whether its version has the fix, and what to do next.
- Free, no signup
- 1 page load, like a browser
- Never sends attack traffic
- Results in seconds
A plain answer, with the evidence and the next step.
A risk rating, in plain words
Never “safe”, never “vulnerable” as a fact. What your site shows, how much evidence there is, and who acts on it.
Every sign we used
generatorlink header/wp-content/An exact answer in 2 minutes
Paste your PHP version from WordPress or your host's panel, or send your host our ready-made email.
A PDF, or 1 emailed copy
In your inbox in a minute, ready to forward to whoever runs your website.
Readable by AI assistants
Every result has its own address, so ChatGPT and other assistants can check a site for you.
GET /check?url=yourbusiness.com
"risk": "Medium"1 ordinary page load. Nothing that could hurt your site.
Response headers, cookie names (never values) and the page's code, up to 512 KB.
The site and its result, for statistics. Never who checked it, and never sent to analytics.
2 critical flaws in PHP. Fixed on October 21, 2026.
On a server that hasn't been updated, an attacker can run their own code by sending a crafted request, without logging in. PHP runs WordPress, Drupal, Joomla, Magento and many custom sites, so a large share of the web is in scope.
Proof-of-concept code is reportedly public, and security researchers reported attempts to use it within days of the fix. Sites on Webflow, Shopify, Squarespace or Wix don't leave their owners a PHP server to patch.
critical flaws, CVE-2026-109618 and CVE-2026-109619
severity out of 10 (CVSS v4.0)
supported PHP lines got a fixed release
Fixed releases
PHP · Oct 21, 2026| Line | Affected | Fixed in |
|---|---|---|
| 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
| 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
| 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
| 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
| 8.1 and older | No longer updated | Ask your host |
Ubuntu, Debian and Red Hat can add the fix without changing the version number, so an older number is not always unpatched.
We report what your site shows. We never call a site safe.
Your site runs on PHP, but the version is hidden
We found WordPress on this page. Your server keeps its PHP version private, so we can't tell from outside whether it has the fix.
generator: WordPress 6.8.3Find your PHP version and paste it in, or send your host the ready-made email.
Find your version. Most servers hide it, which is good practice.
- 01
- WordPress. Tools, then Site Health, then the Info tab. Expand Server.
- 02
- Hosting control panel. Open Select PHP Version or MultiPHP Manager.
- 03
- Managed host. Check your dashboard, or ask support.
- 04
- Your own server. Ask your developer for the version the web server uses, not just php -v.
- 05
- Compare. You need 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later on your line.
Update PHP, then check again.
- 01
- Update to the fixed release on your line, in your host's panel or through your developer.
- 02
- Restart PHP so every worker runs the new version.
- 03
- Can't update today? Ask for PHP's temporary workarounds. They close only some paths.
- 04
- Check again here. A visible version should now show the fixed number.
- 05
- Something looks wrong? Ask your host to review the server logs.
Questions, with straight answers.
01What can PHP Scanner tell me for certain?
3 things: whether your site runs on PHP you're responsible for, whether the PHP version it shows has the fix, and who updates PHP for you. If your version is hidden, paste it in and we'll rate it exactly. What no outside check can do is promise a site is safe, because proving that would mean attacking it.
02What is PHP2Shell?
PHP2Shell is the name given to 2 critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), fixed on October 21, 2026. On a server that hasn't been updated, an attacker can run their own code by sending a crafted request, without logging in. Any website that runs on PHP and hasn't been updated is in scope, including most WordPress, Drupal, Joomla and Magento sites.
03Does the check attack or stress my website?
No. It makes 1 ordinary page request, plus any redirects. It never sends attack traffic, never tests the flaw and never looks for hidden files. To your server it looks like a single visitor.
04Why is my PHP version hidden?
Most well-run servers turn off the setting that announces the PHP version (expose_php), and services like Cloudflare can hide server details too. That's good practice, but it means you need to look the version up another way. The result page walks you through it.
05My site runs on WordPress. Am I affected?
WordPress runs on PHP, so it depends on the PHP version your host runs, not on your WordPress version or plugins. If your PHP is older than 8.2.35, 8.3.36, 8.4.27, 8.5.12 on its line, or is 8.1 or older, ask your host to update it.
06Can ChatGPT or another assistant use PHP Scanner?
Yes. Every result has its own address, like https://php-scanner.com/check?url=yourbusiness.com, and a plain JSON version at /api/check, so assistants and scripts can check a site and read the answer.
07Our host says we're on PHP 8.1 or older. What now?
PHP no longer releases updates for those versions. PHP published the fix for 7.4, 8.0, 8.1 only as source code to build by hand, and some hosts and Linux distributions add fixes themselves. Ask your host whether the fix is applied, and plan a move to PHP 8.2 or later.
08Do you store my website address or email?
We keep a list of the public sites people check and each one's latest result, for statistics, but never who checked them: no IP address, no visitor id. If you ask us to email your report, we use your address to send it and don't keep it. We keep your email only if you tick "keep me posted" or ask Catch to get in touch. Google Analytics counts visits (with your consent where the law requires it) and never receives the address you checked. The privacy page has the details.
09Who makes PHP Scanner?
Catch Digital, a website and growth marketing agency in Calgary, Canada, built it and pays for it. It's free, there's nothing to sign up for, and it isn't affiliated with the PHP project or The PHP Foundation.
Your marketing department. Already built.
Strategy first, then the ads, the pages they land on and the technology that shows what's working, run by 1 senior team. The goal is simple: a 20-person company that markets like a 2,000-person one.
websites and landing pages
businesses we've built for
on Clutch, from 18 reviews
founded in Calgary, Alberta
We build on platforms that keep their own servers up to date, so a flaw like PHP2Shell is their job, not yours.
Our own platform connects your site to your leads and ad platforms, and tests changes on real traffic.
Qualified leads and cost per qualified lead, not impressions. When numbers disagree, we report yours.
A conversation first, and a plain answer if we're not the right fit.
- PHP: security release announcement, October 21, 2026
- The PHP Foundation: today's PHP security release
- GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- Canadian Centre for Cyber Security: AL26-026
- Datadog Security Labs: PHP2Shell analysis
- The Hacker News: exploit attempts reported