Truvo Free Tools

PHP2Shell checker

PHP2Shell is two critical flaws in PHP that allow code execution without a login. This checker reads the PHP version a site advertises in its response headers, compares it with the fixed releases, and tells you what to confirm on the server.

SOC 2 CC7.1ISO 27001 A.8.8

Last updated Oct 22, 2026, 12:46 UTC

Talk to a security specialist

Share what you need and a consultant will follow up to book a call.

How the PHP2Shell checker works

The check is passive: it sends one ordinary request to the site's home page and reads the response headers. It sends no exploit traffic and stores nothing you enter.

01

Read

The checker requests https://yourdomain/ once and reads the X-Powered-By and Server headers, plus signs of PHP such as a PHPSESSID cookie. It looks for a version string like PHP/8.3.35.

02

Compare

The version is compared with the PHP releases that fix PHP2Shell: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no official fix. A version string from an OS package is flagged separately, because distributions patch without changing the version number.

03

Map

The result names the controls it speaks to: SOC 2 CC7.1 (detecting new vulnerabilities) and ISO 27001:2022 A.8.8 (management of technical vulnerabilities). A vulnerable result is a finding to remediate, with the evidence an auditor expects.

Not sure if PHP2Shell hit you?

Truvo's incident response team scopes PHP exposure, reviews the logs and makes the incident and breach determination with you, then leaves the evidence your auditor and customers will ask for.

Talk to incident response

  • Find every server and site running PHP

  • Review logs for signs of exploitation

  • Decide incident or breach under SOC 2, ISO 27001, GDPR and HIPAA

  • Document the response for your auditor

PHP2Shell checker: frequently asked questions

Run the checker above for a first signal from outside. Then confirm on the server: check phpinfo() from a page only you can reach, check the PHP package changelog for CVE-2026-109618 and CVE-2026-109619 (apt changelog or rpm -q --changelog), and on managed hosting ask the host in writing whether both CVEs are patched for the exact PHP version each site uses.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026, fix both CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and older are end of life and receive no official release. After upgrading, restart every PHP worker and rebuild container images, because running workers keep the old code in memory.

Vulnerable means the site advertises a supported PHP version below the fix. End of life means PHP 8.1 or older, with no official fix. OS-packaged means the version comes from a distribution package, so check the vendor advisory. Patched means the advertised version includes the fix. Version hidden means PHP is in use but the version is not shown.

A clean result shows only what the site advertises. Many servers hide the PHP version, CDNs often strip the header, and distribution packages carry the fix under the old version number. Only a check of the PHP installed on the server confirms whether it is patched.

Yes. The checker sends one normal page request, the same as any visitor's browser, and reads the response headers. It sends no exploit payloads, no uploads and no oversized requests, and nothing you enter is stored.

Copy web and PHP logs from October 17, 2026 onward to safe storage first, then upgrade PHP, restart every worker and rebuild images. Exploitation attempts began before the patch, so review the logs for signs of compromise. The PHP2Shell guide on the Truvo blog walks through each step and the SOC 2, ISO 27001, GDPR and HIPAA obligations.