PHP2Shell Checker
PHP2Shell is a pair of critical PHP flaws. A memory-corruption bug in how PHP cleans up a request after running out of memory can let an unauthenticated attacker run code with the web server's privileges. Paste your PHP versions, or check what a website reports, and see whether you're on a fixed release.
Passive only. Version strings are checked in your browser and never leave it. A website check makes ordinary page requests and reads the response headers. It never sends exploit payloads or tries to trigger the bug.
Accepts bare versions, php -v output, X-Powered-By values and distro package versions. Up to 500 lines. Runs entirely in your browser.
Public http/https URLs only. Redirects are followed, and the headers of every hop are checked. The request runs from scan.mylesagnew.com, so only check sites you own or are allowed to test. See the acceptable use policy.
Many servers hide their PHP version, so a missing header doesn't mean the site is safe.
If a WAF, CDN or expose_php = Off hides the version, check from the inside. Every command below is read-only: it prints PHP versions and searches package changelogs, and changes nothing.
Run the ones that match your setup, then paste all the output into the box underneath.
Analysed in your browser and never uploaded. Lines without a PHP version are ignored, and a CVE found in a package changelog marks that branch as fixed by a backport.
Fixed releases
| Branch | Vulnerable | Upgrade to |
|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 or later |
| PHP 8.4 | < 8.4.27 | 8.4.27 or later |
| PHP 8.3 | < 8.3.36 | 8.3.36 or later |
| PHP 8.2 | < 8.2.35 | 8.2.35 or later |
| PHP 8.1 and older | Every version (end of life) | Move to a supported branch |
How to fix it
Upgrade to PHP 8.4.27 or later, restart PHP-FPM or your web server, then confirm the version again. Linux distributions often patch without changing the version number, so search your package changelog for the CVE ID before deciding you're exposed.
If you can't patch straight away, apply the temporary configuration mitigations in the official PHP advisory, and limit exposure with a WAF or by restricting access. Then patch.
FAQ
Does this tool test whether my server can be exploited?
No. It only compares version numbers against the fixed releases. It never sends payloads or tries to exhaust memory, so it can't harm a server, and it also can't prove a server is exploitable. Treat a "vulnerable" result as "patch this", not as a confirmed compromise.
My distro package says 8.3.6 but I've installed every update. Am I vulnerable?
Possibly not. Ubuntu, Debian, RHEL, AlmaLinux and CloudLinux backport security fixes without changing the upstream version. Run apt changelog php8.3-common | grep CVE-2026-109618 or rpm -q --changelog php-common | grep CVE-2026-109618. If the CVE is listed, you have the fix.
The website check found no PHP version. Is the site safe?
Not necessarily. Most hardened servers set expose_php = Off, and WAFs, CDNs and proxies often strip the X-Powered-By header. There's no safe way to read the version from outside after that, so use the On the server tab: its read-only commands list every PHP build and check whether your distribution has backported the fix.
Why is PHP 8.1 marked critical?
PHP 8.1 and older are end of life, so there's no official upstream fix. Researchers report the vulnerable code dates back to PHP 5.4. Unless your vendor or an extended-support provider ships a backport, move to a supported branch.
Is the version list I paste uploaded?
No. Version checks run entirely in your browser. Only the "Check a website" tab sends anything: the URL you enter, to scan.mylesagnew.com, which fetches it and returns the response headers. Nothing is stored.