On 21 October 2026 a critical flaw in PHP, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), was patched. It lets an attacker run their own code on a server. Paste a web address below and we will read the PHP version the site reports and tell you if it is behind the fix.
We only read the version the site publishes in its own headers. We send nothing harmful and store nothing. Please only check sites you own or look after.
Many servers announce their PHP version in a small piece of text sent with every page, called a header. This tool makes one ordinary visit, reads that version, and compares it with the releases that contain the fix (PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12). It never tries the vulnerability itself.
A well configured server hides its PHP version, which is good practice. If a site hides it, we simply can't tell from the outside, so a "hidden" result is not a clean bill of health. A proper check means looking at the server itself. That is where we come in.
If your site is behind, or you are not sure, we can check the server properly and apply the fix. We look after exactly this kind of thing for businesses across Norfolk and Suffolk.
Talk to us about your site ↗A free technology review. We map your systems, flag the risks and tell you what we’d do first. No obligation to move anything to us.