PHP2Shell Checker is an independent resource that helps website owners, developers and system administrators find out — quickly and safely — whether their PHP is vulnerable to critical security flaws, and exactly how to fix it.
Who’s behind it
PHP2Shell Checker is an independent project. The guides are written by Shayan Abbas, from hands-on experience running production web platforms on PHP and cloud infrastructure. Everything is checked against the official advisories before it goes live.
Why it exists
When PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was disclosed on 21 October 2026, attackers were already probing servers. The official advisories were accurate but written for specialists, and many site owners were left asking two simple questions: am I affected? and what exactly do I do? This site answers both in plain English, with commands you can copy.
How we research and update our guides
- Every guide is based on the official PHP advisories, vendor and distribution guidance, and reporting from established security publications. We list our sources at the bottom of each page.
- We show when each page was last updated, and we revise guides when advisories, fixed versions or vendor guidance change.
- We only publish defensive information. We never publish exploit details or tools that attack systems.
- Found a mistake? Email [email protected] and we’ll correct it quickly.
The open-source checker
Our checker is free and open source under the Apache-2.0 licence (GitHub · npm). It is read-only: it checks the PHP version your server advertises, or the version of a PHP binary on your own machine. The in-browser checker on our home page runs entirely in your browser.
How the site is funded
The guides and tools are free. The site is supported by advertising and by an optional, paid patch help service for people who’d rather have someone else do the upgrade. Neither influences what we recommend — the right fix is always the free one in our guides.
Independence
PHP2Shell Checker is not affiliated with, endorsed by or sponsored by The PHP Group, any Linux distribution or any security vendor mentioned on this site. Product names are used only to identify the software they refer to.