php2shell exposure check

Is a website exposing a PHP version vulnerable to the October 2026 PHP core RCE (CVE-2026-109618 / CVE-2026-109619)? Enter a URL and this reads the PHP version the site reveals from the outside.

Read this first: this only checks whether your site reveals its PHP version to the public. Most sites hide it — so “no version found” or a patched-looking result does NOT prove your site is safe. The bug is in PHP itself and affects almost every unpatched PHP site. A VULNERABLE result is real; treat anything else as “confirm on the server with php -v.”

Detection only — this reads the version banner and public page signals. No exploit traffic. Check only sites you own or are authorized to test.

Does your site run PHP? Very likely. PHP powers roughly three-quarters of all websites, including the platforms behind most small-business sites. If your site is built on any of these, it runs PHP and should be checked and patched:

WordPressWooCommerce DrupalJoomla Magento / Adobe CommerceLaravel cPanel / PleskMoodle phpBBcustom PHP

WordPress alone runs about 43% of all websites — if you have a WordPress site, assume you’re affected until PHP is confirmed patched.

How to read the result & important caveats

This is an external exposure check, not a vulnerability test and not proof:

VULNERABLE — the site reveals a PHP version below the patched baseline (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35). Update PHP and restart the service.
EOL — review — PHP 8.1 / 8.0 / 7.x, long past end-of-life. Almost certainly vulnerable; upgrade to 8.2+ and patch.
PHP detected — version hidden — we can see it’s PHP (e.g. WordPress) but not the version. Not safe — confirm the version on the host.
No PHP detected — no PHP signals from the outside. Still not a clean bill of health; a proxy may strip everything, or PHP may only show on deeper paths.

The only certain answer is on the server: php -v, php-fpm -v, or the hosting panel. Distro-packaged PHP is often patched without changing the version string, so confirm a VULNERABLE verdict on the host before acting.