php2shell · CVE-2026-109618 / CVE-2026-109619

Is your site's PHP patched?

See if your site is affected by “php2shell,” the critical PHP flaw — just enter a URL.

Pip

Hi, I'm Pip! Give me your site's URL and I'll check whether it's affected by this PHP issue.

💡 What happened?

🔑A serious flaw in PHP can let attackers take control of a website from outside
🌐Most PHP sites, including WordPress, are affected
🛠The fix: upgrade PHP to a patched version

📋 This checks only for this one issue. It can't tell whether your whole site (plugins and so on) is safe.

🧭 What the results mean

🟢No update needed — you’re covered for this issue
🔴Update required — affected by this issue
🟠Needs review — OS-packaged PHP; the number alone can't tell us
🔵Not affected — the site doesn't seem to use PHP
🟡Inconclusive — the version is hidden

✨ Safe versions (this or later is OK)

PHP 8.1 and older are end-of-life. Plan a move to 8.2 or later.

🔍 Couldn't tell? Check it yourself

WordPress

In your dashboard, go to Tools → Site Health → Info, then expand the “Server” section. The PHP version is listed there.

Shared hosting (cPanel and similar)

In cPanel, open MultiPHP Manager to see and change the PHP version for each domain. Other hosts have a similar “PHP version” or “PHP settings” page in their dashboard. If a fixed release isn't offered yet, check your host's status page or contact support.

Take a backup of your site before switching versions.

VPS or your own server

Don't rely on php -v alone. Check the PHP build your web server actually uses, such as PHP-FPM or the Apache module (for example, php-fpm8.3 -v). Ubuntu, Debian, and RHEL-family packages often backport fixes without changing the version number, so also confirm your OS security updates are installed.

A note about phpinfo()

If you uploaded a phpinfo.php file to check your version, delete it when you're done. Leaving it online gives attackers a detailed map of your server.