PHP2Shell security updateLast updated: 2026-10-22 (UTC)

Online PHP version hint

Read a public PHP version hint from a website you manage. Prove control of the domain with a DNS record first. Missing or misleading headers cannot establish whether a PHP vulnerability is fixed.

PHP2Shell · CVE-2026-109618 / CVE-2026-109619 · PHP RCE · PHP security update

Online version hint

Add this DNS TXT record

TXT value

Verification expires after 24 hours; the DNS record remains until you remove it. Keep this tab open, add the TXT record at your DNS provider, then verify. After checking, you can delete this record. No website request is sent until the TXT record is verified.

The hostname is sent to this service and Cloudflare DNS. After ownership verification, the target receives our HEAD request. We do not store submitted domains or results in an application database or analytics. Infrastructure providers may process request metadata.

Version checker

● Runs locally

Paste a version or your PHP output

Get your PHP version

Hosting panel: select your website and look for its PHP version. Copy the full version shown.
WordPress: Tools → Site Health → Info → Server → PHP version.
Terminal access: run this command, then paste its output below.
```
php -v
```

The terminal and your website may use different PHP installations. Confirm the web runtime in your panel too.

Paste the version below, choose your platform, then check it.

More ways to find the version →

Your platform

Your pasted text stays in this tab. No uploads or saved input.

Online version hint: Status

This tool sends one HEAD request to the HTTPS homepage. It does not follow redirects or read page content. Cloudflare-proxied sites are supported. A WAF challenge, blocked HEAD request or hidden version header can still prevent a result. HTTP-only sites and sites without a public address cannot be checked. Use the panel or local checker in those cases. It only recognizes an explicit PHP version in X-Powered-By. CDNs, disabled headers and hosting configurations often hide it. A header can be changed or cached, so it is not proof of the installed package or its security status.

Header only: verify the installed package and web runtime before deciding whether to update.

Cloudflare: HTTP requests ↗

From a version hint to a PHP vulnerability update

A public header is one clue. Confirm the runtime in your hosting panel or terminal and compare the complete vendor package with the platform advisory. Distribution backports and multiple server nodes can make the header misleading.

If the PHP vulnerability fix is available for your installed branch, use that vendor update. If not, review the temporary mitigation limits and test a supported-version migration.

Sources & verification

Checked at 2026-10-22 04:27:48 UTC. Vendor publication and installed runtime verification are separate checks.