Check the PHP behind your website, understand the evidence and find the next step towards patching.
The draft contains placeholders. Confirm remediation and customer impact before publishing.
php -vThis checks command-line PHP. Your web server may run another version. Confirm the active PHP-FPM or Apache runtime with your administrator.
dpkg-query -W 'php*'On Debian / Ubuntu, collect full installed package builds and verify the vendor advisory. Do not publish a public phpinfo page.
docker compose exec wordpress php -vReplace “wordpress” with your service name. Check the active container after pulling or rebuilding and redeploying. A floating image tag alone cannot prove patch status.
Ask your provider whether the PHP runtime serving your site has fixes for both CVEs, and request the installed package build or patch confirmation.
Updating WordPress or its plugins does not update the underlying PHP runtime.
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, critical flaws in the PHP runtime disclosed on 21 October 2026. They can allow remote code execution. Review the official advisories and patch the runtime serving each affected application.
No. This tool reads public version headers without triggering either flaw. Headers may be missing, modified or stale, and one response may represent only one server in a fleet. A fixed version result is evidence about that reported version, not a security audit or compromise assessment.
Hidden versions, vendor backports, custom builds and floating container tags need additional evidence. Check the deployed runtime and full package build. Website mode does not follow redirects or test whether a firewall blocks exploits.
Restart the affected PHP-FPM, Apache or container services as appropriate, verify every deployed instance and follow your vendor’s guidance. Review any suspected compromise separately; installing a patch does not remove an existing compromise.
Pasted evidence is processed locally and is not sent by this checker. Website mode sends the entered address to this application and makes one header request to that destination. No scan history is stored by this feature. Standard infrastructure access logs may still apply. Reports and customer drafts are generated in your browser.
Use StatusCake to track uptime and availability while your team rolls out changes. Uptime monitoring complements your patch checks; it does not verify PHP2Shell remediation.
PHP security release announcement · PHP security advisories · Canonical’s fixed Ubuntu packages
Version assessment only. This tool sends no exploit payloads and does not test code execution. Advisory data is maintained manually; verify current guidance with your vendor.