A FIRST STEP AFTER THE PHP2SHELL NEWS

Concerned about PHP2Shell?
Does your site use PHP?

Start with your website URL. We’ll look for public signs of PHP
and help you take the next step with your hosting provider.

TRY A WEBSITE

Checks for PHP use only. It cannot determine whether a site is vulnerable, patched, or hacked.

WHY THIS CHECK EXISTSReviewed October 21, 2026

PHP2Shell: start by finding where you use PHP.

Huntress reported the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHPCheck helps website owners begin an inventory of PHP use.

The PHP team released security updates on October 21. If your site uses PHP, confirm with your provider that the relevant fixes are installed.

Read the Huntress report ↗Official PHP advisory ↗

FROM CHECKING TO TAKING ACTION

What should you do next?

You don’t need to manage servers to ask the right questions.

01 /

Confirm PHP use

Ask your hosting provider or developer which PHP runtimes serve your site. Include other sites and applications you manage, even if this check is inconclusive.

START AN INVENTORY

02 /

Confirm the fixes

Ask for the installed PHP version and confirmation that both PHP2Shell fixes are applied. Your vendor may provide a backported fix under a different package version.

VERIFY WITH YOUR PROVIDER

03 /

Get help if you suspect a breach

If you see unexpected changes or suspicious activity, contact your host or security team for an investigation. This check cannot detect a compromise.

INVESTIGATE SUSPICIOUS ACTIVITY

A MESSAGE YOU CAN SEND YOUR HOST

“Does my website use PHP? Which PHP version and vendor package serve it? Please confirm that fixes for CVE-2026-109618 and CVE-2026-109619 are applied to every PHP runtime serving my site, and that the updated services are running. If not, what is the plan to secure it?”

The October 21 PHP releases include fixes in 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Use a current patched release or vendor-confirmed package. For older PHP branches, consult your provider about fixes and an upgrade plan. Check the official guidance ↗

UNDER THE HOOD

Small clues. Useful answers.

We look at what a website shares with every visitor.

01 /

< / >

Read the response

We inspect public response headers and cookie names for explicit mentions of PHP.

HEADERS & COOKIES

02 /

⌕

Connect the clues

Page extensions and platform markers help us identify less obvious PHP fingerprints.

URLS & PAGE SOURCE