How to Check for PHP2Shell (CVE-2026-109618): Free PHP2Shell Checker

The fastest way to check a site for PHP2Shell is to run the free PHP2Shell checker, which reads the PHP version the site advertises and compares it with the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35). The checker gives a first signal from outside in a few seconds. Confirming the patch takes one more check on the server, because Linux distributions fix PHP without changing the version number.

Last updated: October 22, 2026, 12:46 UTC

How does the PHP2Shell checker work?

The PHP2Shell checker sends one ordinary GET request to a site's home page, the same request any browser makes, and reads two response headers: X-Powered-By and Server. Many PHP servers add a version string such as PHP/8.3.35 to one of them. The checker compares that version with the releases that fix PHP2Shell and returns a result.

The PHP2Shell checker is passive. It sends no uploads, no multipart posts, no oversized requests and nothing resembling an exploit, and it stores nothing entered into it. Running it against a production site is as safe as loading the home page.

The same PHP2Shell check is also part of the full domain security scan, alongside SPF, DMARC, TLS and security header checks.

What to do after each PHP2Shell checker result

Each PHP2Shell checker result calls for a different next step. The PHP2Shell checker page explains how each result is worked out, and the table below covers what to do.

Why can a PHP version header be wrong about PHP2Shell?

A PHP version header reports the version number compiled into the build, and Linux distributions patch PHP without changing that number. Red Hat, Debian, AlmaLinux and cPanel all published PHP2Shell updates on October 21 that keep the older version string. A Debian PHP 8.2 package can report 8.2.20 and still carry the fix.

Three other things change what a header shows:

• expose_php = Off in php.ini removes the X-Powered-By header entirely, which many hardening guides recommend.
• ServerTokens Prod in Apache removes the PHP module version from the Server header.
• CDNs and reverse proxies often replace or drop origin headers, so the checker sees the proxy, not PHP.

Hiding the version is good practice, and it moves the PHP2Shell check from outside to inside the server.

How to confirm a PHP2Shell patch on the server

Confirming a PHP2Shell patch means checking the PHP that serves web traffic, because the command-line PHP is often a different build. Work through the checks that match the hosting setup.

Check the web PHP version with phpinfo()

Place a file containing <?php phpinfo(); behind authentication or an IP allow list, load it in a browser, note the PHP version and the Server API line, and delete the file. php -v in a shell reports the command-line build, which can differ from the one Apache or PHP-FPM loads.

Check the PHP package changelog for the PHP2Shell CVE IDs

The package changelog is the reliable PHP2Shell answer on a distribution build. Search it for both CVE IDs:

A changelog entry naming both CVEs confirms the fix. No entry means the package predates the fix.

Check which PHP server API is running

The PHP2Shell risk is highest on Apache with mod_php, which researchers confirmed exploitable with default settings. PHP-FPM, FrankenPHP, LiteSpeed and php-cgi are also affected.

Vulnerability scanners read OS packages, so a self-compiled PHP or a PHP inside a container image needs the version check directly.

Check the PHP version in WordPress or cPanel without a command line

In WordPress, go to Tools > Site Health > Info and open the Server section, which shows the PHP version the site is running. An administrator account is enough, with no server access needed.

In cPanel, open MultiPHP Manager to see the PHP version assigned to each domain, such as PHP 8.2 (ea-php82). cPanel names the PHP branch there and ships the patch through its own PHP packages, so ask the host to confirm the package includes the October 21, 2026 PHP2Shell update.

Both views show the version number, which can look unpatched on a distribution or cPanel build that carries the fix. Treat a version below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as a question for the host, and anything on PHP 8.1 or older as an upgrade.

Check managed hosting with the host, in writing

On shared hosting, managed WordPress and cPanel servers, the host patches PHP. Ask the host to confirm in writing that the exact PHP version each site uses is patched for CVE-2026-109618 and CVE-2026-109619, and keep the reply. For a SOC 2 or ISO 27001 audit, the reply is the evidence for CC9.2 and A.8.8.

How to check many sites for PHP2Shell at once

Checking a portfolio of domains for PHP2Shell starts with the same header read the checker uses. A shell loop gives a quick first pass over a list of domains:

while read d; do
  printf '%s  ' "$d"
  curl -sI --max-time 8 "https://$d/" | grep -iE '^(x-powered-by|server):' | tr '\r\n' '  '
  echo
done < domains.txt

Any line showing PHP/8.1 or older, or a version below the fixed release, goes to the top of the list. Domains with no PHP signal still need checking if they host a PHP application. The domain list itself is often the gap: marketing sites, old campaign microsites and acquired brands are frequently missing from the main asset inventory.

What to do when the PHP2Shell check finds a vulnerable version

A vulnerable PHP2Shell result calls for evidence preservation first and the patch second, because exploitation attempts began before the fix existed.

1. Copy the logs. Copy web server, PHP-FPM and PHP error logs from October 17, 2026 onward to storage the web servers cannot write to.
2. Patch. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the vendor package that carries the fix.
3. Restart and rebuild. Restart every PHP worker and rebuild container images. Running workers keep the old code in memory.
4. Re-run the checker and the server checks to confirm the new version.
5. Review the logs for signs of exploitation, such as a web worker starting sh, bash, curl or wget.

Where patching must wait, PHP lists partial mitigations: session.upload_progress.enabled=0, fatal_error_backtraces=0 on PHP 8.5, and request size limits at the web server or proxy. PHP calls patching the only complete fix.

The PHP2Shell guide covers the log signs in detail, when a compromised server becomes a security incident, and the SOC 2, ISO 27001, GDPR and HIPAA obligations that follow. The PHP2Shell tracker lists the current fixed versions and vendor advisories.

Frequently asked questions about checking for PHP2Shell

Why does the checker say OS-packaged for a version below the fix?

The version string carries a distribution suffix such as -1~deb12u1 or -0ubuntu0.24.04.13. Distributions backport the PHP2Shell fix without changing the version number, so search the package changelog for CVE-2026-109618 and CVE-2026-109619 to confirm.

How do I check PHP2Shell on WordPress hosting?

Check the PHP version in WordPress under Tools > Site Health > Info > Server, or in cPanel under MultiPHP Manager. On managed hosting the host patches PHP, so ask the host to confirm in writing that the version the site uses is patched for both CVEs.

Does php -v show whether a server is vulnerable to PHP2Shell?

Not reliably. php -v reports the command-line PHP, which is often a different build from the one Apache or PHP-FPM uses for web traffic. Check the web version with phpinfo() from a protected page.

How do I check PHP2Shell inside a Docker container?

Run the image and print the PHP version with docker run --rm <image> php -r 'echo PHP_VERSION;'. Vulnerability scanners read OS packages, so a PHP compiled into a container image needs this direct check. Rebuild the image after upgrading PHP.

How do I check a list of domains for PHP2Shell?

Read the X-Powered-By and Server headers of each domain with curl in a loop, the same headers the PHP2Shell checker reads. Any domain advertising PHP 8.1 or older, or a version below the fixed release, goes first. Domains with no PHP signal still need an internal check if they host PHP.

A PHP2Shell check is only as complete as the list of domains behind it

The PHP2Shell checker answers what does this site advertise? in seconds. The harder question is whether every site that uses PHP is on the list to check, including the marketing site, the old microsite and the acquired brand's domain. Teams that keep a current asset inventory typically finish the PHP2Shell check in an afternoon, and the same inventory is the evidence SOC 2 CC7.1 and ISO 27001 A.8.8 ask for.

Run the free PHP2Shell checker on each domain, or the full domain security scan for PHP2Shell plus email, TLS and header checks. If a check turns up a vulnerable server and the team needs help with the log review or the incident decision, Truvo's incident response team can work through it with you.

Sources

• PHP advisory GHSA-w8hw-w9fx-j79w, CVE-2026-109618 (October 21, 2026)
• PHP advisory GHSA-6wmf-4rv5-p3rp, CVE-2026-109619 (October 21, 2026)
• Datadog Security Labs, PHP2Shell analysis (October 21, 2026)
• Amazon Threat Intelligence, PHP2Shell exploitation before disclosure
• Red Hat security bulletin RHSB-2026-013