php2shell Exposure Check

Find out if your website shows signs of php2shell exposure.
Free, fast and no login required.

php2shell (CVE-2026-109618 and CVE-2026-109619)
is a critical flaw in PHP, the software behind about 70% of websites. The FBI recommends updating affected systems immediately, or taking them offline until you can. This check gives you a quick first look at where your site stands.

How it works

Enter your website address. The check looks at information your server already shares publicly, like the PHP version it reports, and compares it to the versions that fix php2shell. It doesn’t log in, change anything or attempt an attack.

What your results mean

  • Likely exposed: Your site reports a PHP version that doesn’t include the fix. Contact your host or developer today.

  • Patched version detected: Your site reports a fixed version (8.5.12, 8.4.27, 8.3.36, 8.2.35 or later). Confirm with your provider that all of your systems were updated, not just this one.

  • Not detected: Your server doesn’t publicly report its PHP version. That’s common and good practice, but it doesn’t mean you’re safe. Ask your provider to confirm directly.

Know the limits

This is a quick outside look, not a full security assessment. Some servers hide their version, and some vendors apply fixes without changing the version number. A clean result covers only the address you entered, not your online store, portals, phone system or other web-based tools. If an attacker got in before the fix, updating alone won’t remove them.

Only check websites you own or manage.

Want a definite answer?

CTRL-A is a Riverside-based managed IT and cybersecurity provider serving businesses across the Inland Empire. We can check every website, portal and web-based system your business relies on, confirm which are patched and look for signs that anyone got in before the fix.

Book a Call‍ ‍| ‍ ‍Read: PHP2Shell: What Business Owners Should Know