CCL Vulnerability Checks · CVE-2026-109618 · CVE-2026-109619

PHP2Shell: check what your website reveals.

A quick, low-impact look at the PHP version advertised by a public website. Get the evidence, understand its limits, and know what to verify next.

Free public check

Check a website

Enter a public domain, IP address or web address that you own or manage. We check its homepage.

The check requests the public homepage and reads response headers. It sends no exploit, upload or test payload. It cannot inspect hidden PHP versions, other applications or the wider hosting environment.

THE ISSUE

Why PHP2Shell matters

Two PHP runtime vulnerabilities can permit remote code execution on affected web servers. The fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

The runtime is shared

An affected PHP installation can serve more than one application. A check of one public page cannot assess every application or host behind it.

Visible is not verified

A response header can advertise a version, but it may come through a proxy or omit a vendor security backport. Confirm the installed package before acting.

Hidden is not safe

Many sites reveal no PHP version at all. That is a limit of a remote check, not evidence that a server is patched.

Source: PHP security advisory, 21 October 2026

OUR METHOD

How the check works

Enter a site you manage.

We use the public homepage, even if you paste a longer URL.

Read what it advertises.

We make a normal GET request and inspect the X-Powered-By and Server response headers. Same-site redirects may require further normal requests.

See the evidence and next step.

We compare an advertised version with PHP’s fixed releases. When the version is hidden or ambiguous, we say so.

Common questions

What this result means

Does a "fixed version advertised" result prove my site is safe?

No. It tells you what one public response advertised at the time of the check. It cannot verify every server, PHP installation or application behind that address.

What if the PHP version is hidden?

The result is undetermined. Ask your hosting provider or administrator for the installed PHP package and its security patch status.

Can an older version number have a security fix?

Yes. Some Linux distributors backport fixes without changing the upstream version number. Check the distributor's package advisory before replacing software or spending money on remediation.

Does this check test whether an attacker can exploit my site?

No. It sends no exploit or disruptive probe. A version found in a header is a reason to verify patch status, not proof of exploitability.

What about shared hosting or an IP address?

An IP address may serve several websites and return a default page. This check covers only the response it receives. It cannot inspect neighbouring sites or separate PHP installations on shared infrastructure.

BEYOND A SINGLE CHECK

Need a clearer picture?

CCL can help verify PHP patch status and assess your wider exposure. For ongoing visibility, CCL Protect includes vulnerability scanning with expert interpretation.

Ask CCL to verify →Explore CCL Protect →