Understand the PHP version
If your server exposes a PHP version, we compare it with the published PHP2Shell patches. Hidden versions remain explicitly undetermined.
Free PHP security check
PHP security.
Get clarity.
Could the PHP vulnerability affect your website? Check publicly visible signals and find out what to do next.
- No account needed
- No email needed for results
- No changes to your website
In focus: PHP2Shell
On 21 October 2026, PHP released updates for two critical vulnerabilities. We help you understand where your website stands.
Official PHP advisory 01 / Check your website
Where does your website stand?
A gentle initial check of HTTP headers. Not a full security audit or an attempt to exploit a vulnerability.
Additional observations
- HTTPS connection
- HSTS header
- MIME-sniffing protection
- Content Security Policy
These observations apply only to the response received. A missing header does not prove a PHP vulnerability. A present header does not confirm a PHP patch.
Servers can hide or change version information. A CDN can hide the origin server. Hosting updates can retain an older version number. This result is therefore not a security clearance.
Let us help you clarify this.
Leave your email address. We will review the result and contact you personally about the next steps.
Thank you! Your request has been saved. We will get back to you.
You can also reach us at office@mxb-solutions.com.
Results you can put into context
What this check tells you.
See basic protections
We check whether the destination uses HTTPS and selected security headers. This provides additional context about its configuration.
Know your next step
You receive a clear assessment. If you need help, we can work with your hosting provider and support further checks.
Background · Reviewed 22 October 2026
PHP2Shell: What website owners should know.
CVE-2026-109618 and CVE-2026-109619 affect the PHP runtime. Under certain conditions, an attacker can execute code on the server. The relevant component is your hosting provider’s PHP installation, not just your CMS version.
CVE-2026-109618CVE-2026-109619
Source and current guidance: PHP.net | PHP branch | Fixed from |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
This table shows the patch level for these two vulnerabilities, not a general recommendation for the latest PHP version. Distribution packages may include the fixes under older version numbers.
Frequently asked questions
Clear answers about the check.
Can the check confirm that my website is secure?
No. It evaluates publicly visible HTTP headers. It does not test your application for every vulnerability or run an exploit. A reliable PHP2Shell assessment requires checking the installed PHP package and all running instances with your hosting provider.
Why is my PHP version not detected?
Many hosting providers deliberately hide version information. Caches, proxies and CDNs may also conceal it. A website might not use PHP at all. Without a visible version, the result remains undetermined; that does not prove a vulnerability.
Does an older version number always mean it is affected?
Not necessarily. Linux distributions and hosting providers can backport security fixes into older packages. The HTTP header version often does not show these patches. Ask for the full package version and confirmation for both CVEs.
Is a WordPress update or firewall enough?
Updating your CMS does not replace a PHP runtime update. A firewall may block certain attacks but does not prove that PHP is patched. Coordinate the PHP update with your hosting provider.
What is tested on my website?
We request HTTP headers from the homepage and a limited number of redirects. We do not send exploit payloads, try passwords or change content. Only check websites you operate or have permission to check.
Do I need to provide my email address?
No. The result appears directly in your browser. Only provide your email if you want MXB Solutions to contact you about it. This is not a newsletter signup.
MXB Solutions
Still need an update? We can help.
We help review your hosting environment, prepare the update and check your application afterwards.