Is my website affected by PHP2Shell? How to check in 2 minutes

PHP released fixes on October 21, 2026 for 2 critical flaws known together as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Proof-of-concept code is reportedly public, and security researchers reported attempts to use it within days of the fix. If you run a business website, 3 questions decide whether you need to act.

1. 1Find out whether your website runs on PHP. WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel sites do. Webflow, Shopify, Squarespace and Wix sites don't run PHP that you manage.
2. 2Find out which PHP version it runs. The fixed releases are 8.2.35, 8.3.36, 8.4.27, 8.5.12. Anything older on those lines has the flaw, and PHP 8.1 and older only got source-code fixes.
3. 3Find out who updates PHP for you. On shared or managed hosting that's your host; on a server you run yourself, it's your developer.

What an outside check can tell you

A free online check like PHP Scanner loads your page once, the way a browser does, and reads what your server sends back: headers, cookie names and the page's code. That's enough to tell whether a site runs on PHP, which platform it uses, and often which PHP version it reports.

• It can tell you: whether your site runs PHP, the PHP version when your server reports it, and who most likely updates it.
• It can't tell you: whether your host already patched a hidden version, whether other parts of your business (a store or client portal on another address) run PHP, or whether someone already used the flaw.

If your PHP version is hidden

Many servers keep their PHP version private, which is good practice. Then you need the exact version from inside: in WordPress, open Tools, then Site Health, then the Info tab and Server. In a hosting control panel, look for Select PHP Version or MultiPHP Manager. How to check your PHP version walks through each.

Paste that version into your PHP Scanner result for an exact rating. Or send your host the ready-made email from your result; they can confirm both the version and whether the fix is in.

If your PHP is older than the fix

• Ask your host or developer to update PHP to the fixed release for your line, then restart PHP.
• If they can't update today, ask for PHP's temporary workarounds. They close only some attack paths. PHP2Shell workarounds lists them.
• If you run PHP 8.1 or older, plan a move to a supported version. PHP 8.1 reached end of life on December 31, 2025. PHP versions and end-of-life dates has every date.