About php2shell.app

php2shell.app is an independent resource that helps site owners and administrators find out whether their PHP installation is affected by CVE-2026-109618 and CVE-2026-109619, and how to fix it in their specific environment. It is not affiliated with the PHP project or any vendor.

How the checker works

The checker sends one ordinary GET request to the homepage you enter, following at most three redirects, with the user agent php2shell.app-checker/1.0 (+https://php2shell.app/about). It reads response headers and the first 64 KB of HTML, then compares any reported PHP version with the fixed versions. It sends no exploit, no POST bodies and no uploads, and never requests other paths or ports. Requests to private, loopback and cloud metadata addresses are refused.

Where the data comes from

Only from php.net, the PHP security advisories on GitHub, and official distribution security trackers (Ubuntu, Debian, Red Hat). Every table lists its sources and the date they were checked. We do not publish exploit code or proof-of-concepts.

If you saw our user agent in your logs

Someone entered your site in the checker. It made a single homepage request. If you want your domain excluded, contact us.