PenBot
CVE-2026-109618 and CVE-2026-109619: disclosed October 2026

Is your PHP site exposed to PHP2Shell?

PHP2Shell is the nickname for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. On an affected server, a crafted request can let an attacker run code: no login required. We check your site from the outside and give you a plain-English verdict.

One target, one check. $9 Free for 2026: no payment, only ownership verification.

Price

PHP2Shell Check

One targeted check for CVE-2026-109618 and CVE-2026-109619

$9FREEfor 2026

  • Outside-in probe: no agents, no server credentials
  • Plain-English verdict backed by the raw evidence
  • Fix guidance you can act on today
  • Shareable report link for your team
  • No payment in 2026: the fee is waived for the whole free period
Start the check

What is PHP2Shell?

Most websites leak small hints about the software that runs them: a version number in a response header, an error page that mentions a file path. PHP2Shell turns those hints into a serious problem: on certain PHP versions, an unauthenticated attacker can send one crafted request and end up running code on your server.

The PHP project shipped emergency releases in October 2026 that fix these two vulnerabilities. If your PHP is older than those releases, an update is the whole fix: no workarounds to research, no third-party patch to hunt down.

We verify the exact patched versions against the official advisories before every run. When we cannot determine your version, we say UNKNOWN rather than guess, and you can re-run the check once your version is visible.

How it works

  1. Step 1

    Enter your site address

    Give us the URL. The probe only ever touches that one domain, never your neighbors.
  2. Step 2

    Prove you own it

    Upload one small text file, add one meta tag, or add one DNS record. Copy and paste, that is all. We could never scan sites we do not own.
  3. Step 3

    Get your verdict: free for 2026

    One page, plain English: VULNERABLE, SAFE, or UNKNOWN. The $9 fee is waived for 2026: nothing to pay.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. On an affected PHP server, a crafted web request can lead to remote code execution: an attacker can run code on the server without logging in. Exact affected versions live in the official PHP advisory, and our probe compares the version we detect against the patched releases.

How does the free check work?

You enter your site address, prove you own it, and run the check: the $9 fee is waived for 2026, so no payment is taken. Our probe then looks at your site the way a visitor would: it reads HTTP response headers, error pages, and other public fingerprints to determine your PHP version, and compares that against the patched releases for the PHP2Shell vulnerabilities. Nothing is installed on your server.

Do you need access to my server?

No. We verify ownership with a single file upload, a single meta tag, or a single DNS record. After that we only talk to your site like any other visitor. We install no agent, we ask for no credentials, and we never exploit anything: the probe reads public responses only.

What do the verdicts mean?

VULNERABLE means we detected a PHP version that predates the October 2026 fixes. SAFE means the evidence points to a PHP version that includes those fixes. UNKNOWN means your server hides its PHP version: you get manual check instructions, and you can re-run the check once the version is visible.

How long does it take?

Most checks finish in a few minutes after you press the button. The report is a single page: verdict, what we tested, and exactly what to change if you are vulnerable.

Is the check safe for my site?

Yes. The probe makes a small number of read-only requests, never exploits anything, and identifies itself in a published scanner policy so your admins always know who asked.
PHP2Shell Check: Is Your PHP Site Vulnerable? Free for 2026