Digital Hosting logo
Hosting Finder
Web HostingCloudVPSDedicatedWordPressEmailDomains

PHP2SHELL tool

PHP2SHELL exposure checker

Enter a site you own to see whether it reveals an out-of-date PHP version. This is a passive check: we read only what your server already shows and never test the flaw. Most well-configured servers hide their PHP version, so a 'can't tell' result is common and is not bad news.

Only check sites you own or administer. We do not store the domains you enter.

The definitive check

A passive check can only flag an obviously old, exposed version. To know for certain, run this on a server you manage. A match means the fix is installed.

Debian or Ubuntu:

zgrep CVE-2026-109618 /usr/share/doc/php*-common/changelog.Debian.gz

RHEL, AlmaLinux, or Rocky:

rpm -q --changelog php-common | grep CVE-2026-109618

On managed hosting, ask your host or check its status page. Our study collects what the major hosts have said.

How to read a result

  • Likely exposed: a PHP version is visible and it is below the fixed build for its branch. Patch now.
  • Looks patched: a visible version is at or above the fixed build. Confirm with the check above, since a visible version can be stale.
  • Can't determine: no PHP version was visible, which is normal and good practice. Use the server-side check.

New to this? Read the PHP2SHELL explainer.