Is your PHP version affected?

PHP version check

Is your PHP
version affected?

Start with your URL. We read the version your server reports and compare it to the patched releases.

Read-only. We read response headers only, so a clean result may still need confirming with your host.

1
Enter your URLPaste a public URL.
2
We read the headerOne request, headers only.
3
See where you standAffected, patched, or inconclusive.

The vulnerability

What is PHP2Shell?

PHP2Shell is the common name for two related memory-safety vulnerabilities in core PHP, tracked as CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2.

The flawed code is in PHP itself, not in your application. A site can be affected even when its own code is perfectly safe, including a simple "Hello World" page, as long as it runs an affected PHP version.

Sites on the releases patched on 21 October 2026 (8.5.12, 8.4.27, 8.3.36 and 8.2.35) are protected. WordPress, Drupal and Joomla were used as representative targets, but exploitation does not require any particular application.

Patched & safe: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
Affected: Any 8.2 to 8.5 release before the fix
No standard fix: PHP 8.1 and older

Technical details

For technical analysis and coordinated-disclosure details, read the official posts from the research and response teams.

Read official post

A little context

What we check, and what you should know.

What is the vulnerability?

CVE-2026-109618 and CVE-2026-109619 let specially nested multipart field names consume excessive memory while PHP parses a request, before your application runs. On affected configurations this can exhaust the memory limit and terminate a request or worker.

Will this check affect my website?

No. It sends one HEAD request (falling back to GET) and reads the response headers. It never sends a multipart body or anything that could exhaust memory.

Does a clean result mean I'm safe?

Not on its own. A version header can be hidden or spoofed, so an inconclusive or patched reading is a signal, not proof. Confirm your installed version and memory_limit with your host.

Which versions are fixed?

The fixes shipped on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no standard upstream release, so move to a supported branch. Updating PHP is the only complete fix.