Skip to main content
Start a project

Is your PHP website exposed to the PHP2Shell flaw?

On 21 October 2026, PHP fixed two critical flaws that let attackers take over a server remotely. Enter your website's address: we look at what it shows any visitor and tell you whether you need to act.

  • Result in 10 seconds
  • Reserved for the website's owner
  • No attack sent

Free tool

It must belong to the tested website's domain: for example you@mysite.com for mysite.com. Gmail, Outlook or Yahoo addresses are not accepted.

Terms of use of the test
  • The test is reserved for the website's owner or a person they have expressly authorised. Testing a website without authorisation is forbidden.
  • The test is passive: it loads the home page once, like a browser, and reads public information. It sends no attack request.
  • The result is indicative, provided free of charge and without warranty. It does not replace a security audit. AD AZUR DIGITAL cannot be held liable for decisions made on its basis.
  • Your name, email, the accepted declaration, its timestamp and your IP address are kept for 12 months with the result, as proof of the request.
  • In case of abuse or false declaration, we may refuse access to the test and pass these details on to the competent authorities. The user remains solely responsible for their declaration.

We keep your request (name, email, declaration, IP address) and the result for 12 months, as proof that the test was requested by the website's owner. Details in our privacy policy.

How to read the result?

  • Patched version

    PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and later include the PHP2Shell fixes.

  • Urgent update

    An older version of the same branch is vulnerable. Updating is the only complete protection.

  • No official fix

    PHP 8.1, 8.0, 7.x and older no longer get fixes: only a migration protects you for good.

  • Hidden version

    Good practice, but the test cannot conclude: check the version on the server.

Check your PHP version yourself

If your website hides its version, three simple ways tell you which one it runs.

  1. 01

    In your hosting panel

    cPanel, Plesk or your host's client area show the website's PHP version, often under « PHP version selector » or « PHP settings ».

  2. 02

    In WordPress

    Tools > Site Health > Info > Server: the « PHP version » line gives the exact number.

  3. 03

    On the command line

    On the server, php -v shows the version. Note: the website may use a different version than the command line.

FAQ

Frequently asked questions

The questions our clients in Tunisia, Europe and the Middle East ask before starting. Another question? Write to us.

Ask a question

What is PHP2Shell?

It is the name given to two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 (CVSS 4.0). In some configurations they allow remote code execution on the server. PHP fixed them on 21 October 2026.

Is my WordPress website affected?

WordPress runs on PHP: a WordPress website is affected if its server's PHP version is not patched. Updating WordPress and its plugins is not enough: PHP itself must be updated.

Does the test attack my website?

No. We load your home page once, as a browser would, and read what the server shows publicly. No attack request is sent. The test is reserved for the website's owner: it asks for an email of its domain and a declaration, kept for 12 months as proof.

My website is behind Cloudflare: am I protected?

Cloudflare deployed firewall rules against PHP2Shell, which lowers the risk. But a firewall rule can be bypassed: updating PHP remains the only complete protection.

What if my version is no longer maintained?

You need to migrate to a maintained PHP version, which may require adapting code, theme or plugins. It is a good time to decide: migrate, or rebuild a lighter website that is easier to keep up to date.

Need a full check?

We check the real PHP version on your server, apply the fix or the migration, and make sure the website still works afterwards. Tell us about your website: answer within one business day.

Reply within one business day

Describe your project

Ask a question