Emergency security check · 22 October 2026
Is your PHP
update confirmed?
Check a website’s public PHP version evidence for the two PHP2Shell vulnerabilities, then see what your hosting provider needs to verify.
Urgent PHP security releases
Update PHP itself, including the runtime behind your website
PHP has released fixes for two critical remote code execution vulnerabilities. A WordPress, plugin or theme update does not establish that PHP has been patched. Ask your host to confirm both fixes and that every web-serving PHP worker has been restarted or replaced.
Read PHP’s security advisory · Advisory rules reviewed 22 October 2026.
Read the PHP2Shell security bulletin. A plain-English guide to the risk, safe-check limits, the IT-provider patching process and costs, with a detailed technical appendix.
Download security bulletin (PDF, 4 pages)Point-in-time evidence
An advertised version is a clue. Hidden PHP, an updated banner, a firewall or a maintenance page cannot prove that the underlying installation is patched.
What this result covers
Cookies and response bodies are not retained. This tool has no saved history, email delivery or scheduled monitoring. Your downloaded PDF and JSON contain the submitted public target, endpoint evidence and UTC times.
Can this find what an attacker could find?
It checks public responses, canonical redirects and a normal PHP entry point. A PHP session cookie is reported as a hint; its value is discarded. Hidden PHP versions and blocked requests receive specific explanations rather than a generic verdict.
Proving these memory-corruption flaws can involve triggering memory exhaustion or stale worker state. A failed exploit attempt would not prove a patch. This checker does not perform those exploit tests. Even Tenable’s current PHP2Shell web check relies on the application’s reported version. Where the web evidence is insufficient, the patch status remains unverified.
Upstream fixes · both CVEs
Fixed PHP releases
| PHP branch | First fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
PHP 8.1 and older need a verified vendor backport or an upgrade. Vendor packages can retain an older version number after a security fix; compare the complete installed package with your vendor’s advisory.
When the version is hidden
Confirm with your host
- Inventory every PHP application, origin and web-serving pool, including systems behind a CDN.
- Get the installed package name and full build version, plus the vendor advisory covering both CVEs.
- Confirm all web workers use the corrected build. The command-line PHP version may differ from the website’s runtime.
- If a patch cannot be applied promptly, use the PHP team’s current guidance to reduce exposure or isolate the service.
Do not publish a phpinfo() page for this check. WAF rules and temporary configuration changes do not establish a complete fix.