Is this the same as the free Quick Scan?

No. This checker runs only the PHP2Shell version assessment. It does not start a Quick Scan or Full Audit, create an audit report, or use your audit credits.

Can you tell if a site has already been hacked?

No. This is a passive public-response check. It does not exploit PHP, run scripts on your site, log in, or inspect server files. Investigating a suspected compromise requires access to host logs and other server evidence.

Why might my result be inconclusive?

Many hosts hide PHP versions. A CDN, blocked request, vendor-modified version or redirect to another website can also prevent verification. Inconclusive does not mean safe. Use the backend-agent prompt or ask your hosting provider to verify the running PHP build.

What does a fixed-version result mean?

The version advertised by the sampled response meets the upstream fixed-release threshold. A response header can be stale or modified, and does not prove every server or PHP worker is patched.

What about WordPress or a modern JavaScript frontend?

WordPress commonly uses PHP, while a JavaScript frontend may still connect to a PHP backend. This check assesses the version evidence actually returned by the public homepage. It does not infer runtime safety from the frontend framework or CMS name.

Website securityFree · No signup

PHP2Shell checker

Compare your website’s public PHP version with the PHP2Shell fixed releases.

Public response onlyNo exploit attempts

About this check

AuditHQ’s free PHP2Shell checker compares the PHP version advertised by a public website with the fixed releases for CVE-2026-109618 and CVE-2026-109619. Enter a website to get an older-version warning, a version-threshold match or an inconclusive result. No signup or audit credits are required. It does not verify exploitability, compromise or hidden PHP runtimes.

Published by AuditHQ. Guidance reviewed 23 October 2026. About AuditHQ · PHP2Shell check methodology

Understanding your result

A public response can reveal a PHP version. It cannot show us every server behind your site. Your result keeps that distinction clear.

Older version advertised

The banner is below a fixed upstream release. Verify the running build and vendor patches promptly, then update if needed.

Version threshold met

The advertised version meets the fixed-release threshold. This is a version comparison, not a certificate that the site is safe.

Could not verify

The PHP version is hidden, ambiguous or unavailable. Take the backend prompt below to your AI agent or hosting provider.

The issue

What is PHP2Shell?

PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution in PHP installations serving web requests. The public website can be the entry point even though the flaw lives in the server runtime.

AuditHQ makes a bounded request to your public homepage and inspects its response headers. It does not send exploit payloads, log in, or execute your website’s scripts. Headers can be hidden or modified, and vendors may backport patches.

Read the official PHP security advisory

Guidance reviewed 23 October 2026. Confirm current vendor advice before patching.

Fixed upstream releases

PHP branch and first fixed release for PHP2Shell
PHP branch	First fixed release
PHP 8.2	8.2.35
PHP 8.3	8.3.36
PHP 8.4	8.4.27
PHP 8.5	8.5.12

Use the fixed release for your branch or a later fixed supported build. For older or vendor-maintained builds, verify the provider’s advisory for both CVEs.

If your version needs attention

01
Verify the running build
Ask your host which PHP build actually serves web requests. Check all workers and replicas, plus any vendor backports for both CVEs.
02
Patch, rebuild and restart
Move affected services to a fixed supported release. Rebuild container images and restart or replace every affected PHP worker. Hiding the header does not patch PHP.
03
Confirm the release
Verify the versions running after the change. A public recheck can compare the new banner; host-side evidence confirms the real patch status.

How we tested the checker

On 23 October 2026, we submitted a temporary controlled website through this public form using official PHP runtimes. PHP 8.4.26 produced an older-version warning; PHP 8.4.27 passed the version comparison. Suppressing the version header on PHP 8.4.26 produced an inconclusive result.

These controls exercised the live form and assessment service without injected results. They verify version-header detection, not exploitability or successful exploitation. The temporary test servers were shut down afterwards.

Backend verification

Verify your backend

Your own coding or operations agent may have access to the backend that a public checker cannot see. This prompt asks it to verify the actual runtime, preserve uncertainty and propose a fix.

Start read-only. Keep production changes under your control. You can also send the prompt to your hosting provider.

Your backend verification prompt

Review my production website for PHP2Shell exposure (CVE-2026-109618 and CVE-2026-109619). Start read-only. Do not run exploits or deploy changes.

Identify the actual production origins and any PHP-FPM, Apache/mod_php, CGI, FrankenPHP or LiteSpeed services, including containers and replicas. A JavaScript frontend or local CLI php -v alone does not establish the PHP version serving web requests.

Verify the running builds against PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later fixed supported releases. Check the official advisory and current guidance: https://www.php.net/archive/2026.php#2026-10-21-5

For distro/LTS packages, verify the exact vendor package revision and backports for BOTH CVEs. Do not infer patch status from a public banner alone. Report verified-fixed, needs-update, no-PHP and unverified services separately, with dated evidence.

Propose the smallest update/rebuild plan, restart or replace every affected worker/replica, and verify the builds actually serving traffic after release. Hiding a response header is not a fix. Obtain approval before production changes unless already authorized.

If compromise is suspected and you have authorized host telemetry, separately inspect relevant PHP-worker child processes, request/error logs and unexpected files. Do not print credentials, environment-file contents or customer data. If production access is missing, list the exact facts the hosting provider must confirm.

Before you run the check

Is this the same as the free Quick Scan?: No. This checker runs only the PHP2Shell version assessment. It does not start a Quick Scan or Full Audit, create an audit report, or use your audit credits.
Can you tell if a site has already been hacked?: No. This is a passive public-response check. It does not exploit PHP, run scripts on your site, log in, or inspect server files. Investigating a suspected compromise requires access to host logs and other server evidence.
Why might my result be inconclusive?: Many hosts hide PHP versions. A CDN, blocked request, vendor-modified version or redirect to another website can also prevent verification. Inconclusive does not mean safe. Use the backend-agent prompt or ask your hosting provider to verify the running PHP build.
What does a fixed-version result mean?: The version advertised by the sampled response meets the upstream fixed-release threshold. A response header can be stale or modified, and does not prove every server or PHP worker is patched.
What about WordPress or a modern JavaScript frontend?: WordPress commonly uses PHP, while a JavaScript frontend may still connect to a PHP backend. This check assesses the version evidence actually returned by the public homepage. It does not infer runtime safety from the frontend framework or CMS name.