---
title: "PHP2SHELL Exposure Checker | Digital Hosting"
url: https://digitalhosting.com/php2shell-check
description: "A passive, non-invasive check for a site you own: see whether it reveals an out-of-date PHP version, plus the definitive command to confirm on your own server."
lang: en
---

PHP2SHELL tool

# PHP2SHELL exposure checker

Enter a site you own to see whether it reveals an out-of-date PHP version. This is a passive check: we read only what your server already shows and never test the flaw. Most well-configured servers hide their PHP version, so a 'can't tell' result is common and is not bad news.

Only check sites you own or administer. We do not store the domains you enter.

## The definitive check

A passive check can only flag an obviously old, exposed version. To know for certain, run this on a server you manage. A match means the fix is installed.

Debian or Ubuntu:

zgrep CVE-2026-109618 /usr/share/doc/php*-common/changelog.Debian.gz

RHEL, AlmaLinux, or Rocky:

rpm -q --changelog php-common | grep CVE-2026-109618

On managed hosting, ask your host or check its status page. Our study (https://digitalhosting.com/php2shell-host-status) collects what the major hosts have said.

## How to read a result

- **Likely exposed:** a PHP version is visible and it is below the fixed build for its branch. Patch now.
- **Looks patched:** a visible version is at or above the fixed build. Confirm with the check above, since a visible version can be stale.
- **Can't determine:** no PHP version was visible, which is normal and good practice. Use the server-side check.

New to this? Read the PHP2SHELL explainer (https://digitalhosting.com/php2shell).

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "Digital Hosting",
    "url": "https://digitalhosting.com"
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "name": "Digital Hosting",
    "url": "https://digitalhosting.com",
    "logo": "https://digitalhosting.com/og-image.png",
    "email": "hello@digitalhosting.com",
    "description": "Independent hosting review site — comparisons for web hosting, VPS, WordPress hosting, business email, and domain registration. Not a hosting provider.",
    "parentOrganization": {
      "@type": "Organization",
      "name": "TetraCore",
      "address": {
        "@type": "PostalAddress",
        "addressRegion": "OH",
        "addressCountry": "US"
      }
    }
  }
]
```