PHP2Shell Check: Is Your Website Patched?

Enter your website address. We check what your server reveals about PHP, who hosts it, and whether a firewall such as Cloudflare sits in front, then match that against what your host and firewall provider have said about PHP2Shell.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP flaws that can let an attacker run code on a web server without logging in. PHP released fixes on Oct 21, 2026: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no official fix.

We load your homepage once, the same way a browser does. No attacks, no logins, nothing installed. We keep a record of each check; see the FAQ below.

What is PHP2Shell?

PHP2Shell is the name given to two flaws in PHP itself, the language that runs WordPress, Drupal, Joomla, Magento and many other sites. Both are rated 9.2 out of 10 (CVSS v4.0). Because the flaws are in PHP rather than in your website's code, updating WordPress or your plugins does not fix them. The PHP running on your server has to be updated.

Fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12, published Oct 21, 2026. PHP 8.1 and older receive no official fix; some hosts and Linux vendors have backported one. (php.net advisory)
Exploitation: PHP's advisory describes a demonstrated exploit and rates the risk highest for Apache mod_php. Security firm watchTowr reports exploitation attempts in the wild since Oct 21. As of Oct 22, CISA had not added the flaws to its Known Exploited Vulnerabilities list. (watchTowr)
Workarounds: PHP lists settings that reduce exposure, such as turning off session upload progress, but states there are no complete mitigations and that updating is the only safe choice.
Same version number, patched build: many hosts (for example GoDaddy Web Hosting, Hostinger and CloudLinux-based hosts) patch PHP without changing the version number. On those hosts, a PHP build date of Oct 21, 2026 or later is the sign of a fixed build.

Who found PHP2Shell: the original research

PHP's own advisories credit researchers from three teams. Each published its own account, and they are the best sources for how the flaws work and how they were found.

Calif: "php2shell, a tale of two PHP remote vulnerabilities" by Ryan Austin. The discovery story and technical explanation, tracing the root cause back to a 2004 bug.
Wiz Research: "PHP2Shell: AI uncovers critical RCE vulnerabilities" by Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz (Oct 21, 2026). How out-of-memory errors leave PHP in a broken state, with attacks shown against WordPress, Drupal and Joomla.
OpenAI: "Patch the Planet". OpenAI's account of its part in finding the flaws and coordinating the response.

Official advisories: php.net security advisory · CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) · CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) · The PHP Foundation's statement

What this check can and cannot tell you

From the outside, we can only see what your server chooses to reveal. If your server announces its PHP version, we compare it with the fixed releases. If it hides the version, which most well run servers do, nobody can confirm the fix from outside, including us. In that case we tell you what your host and your firewall provider have publicly said, and how to check the exact version yourself in about two minutes.

A host saying it has patched is good news, but it covers its platform, not necessarily your plan. Self-managed VPS and dedicated servers are usually excluded. A firewall such as Cloudflare can block known attack patterns, but only for traffic that passes through it, and it does not update PHP.

How to find your exact PHP version and build date

WordPress

Log in to your dashboard and go to Tools, then Site Health, then the Info tab. Open the Server section. The PHP version is listed there. Site Health does not show the build date, so on hosts that patch in place, use your hosting panel.

Your hosting control panel

In cPanel, open Select PHP Version or MultiPHP Manager. In Hostinger's hPanel, open PHP Info and look at the Build Date. On managed WordPress hosts such as Kinsta, WP Engine or SiteGround, look under the site's Tools or Settings page. If you can't find it, your host's support team can tell you in minutes.

Command line

If you have SSH access, run php -v; the first line shows the version and build date. The web server can use a different PHP than the command line, so confirm with your control panel too. After updating, restart PHP-FPM and the web server so the fixed version is actually running.

Avoid leaving a phpinfo() page on your site. If you create one to read the build date, delete it right away; it shows attackers far more than your PHP version.

What hosts and firewall providers have said

Public statements as reviewed on Oct 23, 2026. Statements change quickly; follow the source link for the latest. "Says patched" is the provider's own claim, which we have not independently verified.

Hosting providers

Host	Status	What they said
Kinsta	Says patched	Kinsta says PHP security updates were rolled out across its platform for PHP 7.4 and 8.0 through 8.5 (resolved Oct 22, 2026, 08:26 UTC), and that Cloudflare firewall rules stay in place. No customer action required. Source
WP Engine	Says patched	WP Engine reports deployment finished on Oct 22, 2026, naming builds 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12. Flywheel, also part of WP Engine, reports its platform patched on Oct 21. Source
SiteGround	Says patched	SiteGround says it disabled the affected features on all supported PHP versions before the release, then applied the official fixes on Oct 21, 2026. No customer action required. Source
GoDaddy	Managed plans patched	GoDaddy says Managed WordPress (Oct 21), Windows Hosting and Web Hosting (Oct 22) are patched. On Web Hosting the version number may not change; a PHP build date of Oct 21, 2026 or later means patched. VPS customers must update PHP themselves. Source
Hostinger	Managed plans patched	Hostinger says the fix is installed on all hosting plans except VPS (Oct 22, 2026, 07:20 UTC), covering PHP 5.2 through 8.5. The version number may not change; a build date of Oct 21, 2026 or later in hPanel PHP Info means patched. VPS customers must update PHP themselves. Source
Bluehost / HostGator (Newfold)	Rolling out	Bluehost and HostGator said on Oct 22, 2026 that most shared and managed platforms were patched and the rest were in progress. VPS and dedicated server customers must run a package update themselves. Source
WordPress.com / Pressable / WP VIP (Automattic)	Says protected	Automattic says sites on WordPress.com, WordPress VIP and WP Cloud (including Pressable) are protected. It does not name a PHP build. Source
Pantheon	Says patched	Pantheon reports live and pre-production environments patched on Oct 22, 2026, including its long-term-support builds of older PHP. Source
DreamHost	Says patched	DreamHost reports its network patched on Oct 22, 2026, with PHP 8.1 and older covered by mitigations. Source
Namecheap	Says patched	Namecheap reports its shared hosting patched through CloudLinux packages on Oct 22, 2026. Those builds keep the old version number. Source
Cloudways	Says patched	Cloudways reports all active servers running fixed PHP builds, including older versions, as of Oct 22, 2026. Source
Liquid Web	Rolling out	Liquid Web reported a staged rollout in progress on Oct 22, 2026 and told customers on end-of-life PHP to upgrade. Source
Nexcess	Rolling out	Nexcess listed patched builds on Oct 22, 2026 with the incident still open. Source
InMotion Hosting	Rolling out	InMotion reported dedicated servers done, VPS in progress and shared hosting protected by mitigations on Oct 21, 2026. Source
A2 Hosting (hosting.com)	Managed plans patched	hosting.com reports cPanel and Plesk servers patched on Oct 22, 2026. Self-managed VPS is not covered. Source
Rocket.net	Rolling out	Rocket.net reported patches rolling out in waves for PHP 5.2 through 8.5 on Oct 22, 2026. Source
IONOS	No statement found	We did not find a public PHP2Shell statement from IONOS. Ask their support whether your plan runs a patched PHP build.
Pagely	No statement found	We did not find a public PHP2Shell statement from Pagely. Ask their support whether your site runs a patched PHP build.
Hetzner	You manage PHP	Hetzner patched its Webhosting and Managed Server products (Oct 21 to 22, 2026). On cloud and dedicated servers you rent, you manage PHP. Source
OVHcloud	You manage PHP	OVHcloud patched PHP 7.4 to 8.5 on its web hosting clusters (Oct 22, 2026), with older versions in progress. On VPS and dedicated servers, you manage PHP. Source
DigitalOcean	You manage PHP	DigitalOcean says Droplets and existing 1-Click apps must be updated by the customer; App Platform apps need a redeploy. Source
Amazon Web Services	You manage PHP	AWS says it cannot patch running Lightsail or EC2 servers; customers must update PHP or rebuild from updated blueprints. Elastic Beanstalk updates only with managed platform updates turned on. Source
Microsoft Azure	You manage PHP	Microsoft says built-in App Service Linux PHP images are being patched; custom containers and virtual machines are yours to update. Source
Google Cloud	You manage PHP	Google says App Engine standard, Cloud Run and Cloud Functions on PHP 8.2+ update automatically; virtual machines, GKE and custom images are yours to update. Some managed hosts also run on Google Cloud. Source

Firewalls and content delivery networks

Provider	Status	What they said
Vercel	Firewall rules	Vercel added firewall rules on all projects. If you run a PHP runtime there, updating it is your job. Source
Cloudflare	Firewall rules	Cloudflare turned on PHP2Shell firewall rules by default for every plan with its WAF, including Free, from Oct 21, 2026, 03:02 UTC. Pro, Business and Enterprise customers should confirm the Cloudflare Managed Ruleset is deployed with these rules set to Block. Cloudflare reports attackers changing payloads to get around the rules and still says to patch PHP. Source
Akamai	Firewall rules	Akamai says App & API Protector customers are protected, and still says to patch PHP immediately. Source
Imperva	Firewall rules	Imperva says Cloud WAF customers are protected out of the box, and calls patching PHP the primary fix. Source
AWS WAF	Firewall rules	AWS updated its PHP managed rule group; sites pinned to an older rule version must move to the latest. AWS calls the WAF a stopgap, not a fix. Source
Amazon CloudFront	No statement found	CloudFront on its own is a content delivery network. It blocks PHP2Shell only if AWS WAF with the updated PHP rules is attached to it, which we cannot see from outside. Source
Azure Front Door	Firewall rules	Microsoft has published Azure WAF mitigation guidance for PHP2Shell. Whether it is applied depends on your WAF policy, which we cannot see from outside. Source
Fastly	Firewall rules	Fastly says Next-Gen WAF customers can turn on a signal covering both CVEs (Oct 21, 2026). It is not on by default, and Fastly calls it partial protection and urges patching. It applies only to sites using Fastly's Next-Gen WAF. Source
Sucuri	No statement found	We did not find a PHP2Shell-specific statement from Sucuri. Ask Sucuri support whether your firewall plan blocks it.

PHP support timeline

Source: the PHP project's supported versions page (php.net). Dates update automatically.

Version	Status today	Security fixes end	Latest release
PHP 8.5	Active support	Dec 31, 2029	8.5.12
PHP 8.4	Active support	Dec 31, 2028	8.4.27
PHP 8.3	Security fixes only	Dec 31, 2027	8.3.36
PHP 8.2	Security fixes only	Dec 31, 2026	8.2.35
PHP 8.1	End of life	Dec 31, 2025	8.1.34
PHP 8.0	End of life	Nov 26, 2023	8.0.30
PHP 7.4	End of life	Nov 28, 2022	7.4.33
PHP 7.3	End of life	Dec 6, 2021	7.3.33
PHP 7.2	End of life	Nov 30, 2020	7.2.34
PHP 7.1	End of life	Dec 1, 2019	7.1.33
PHP 7.0	End of life	Jan 10, 2019	7.0.33

Why does Cloudflare or a firewall matter?

A content delivery network or web application firewall, such as Cloudflare, Sucuri, Imperva or Akamai, sits between visitors and your web server. It can block common attacks and hide your server's real address. Our check shows which of these, if any, your site sits behind, so you know where your protection starts.

A firewall does not update PHP. It filters known attack patterns, but your server still runs the same code. And if your server's real address can be reached directly, attackers can go around the firewall entirely. Ask your host to make sure your server only accepts traffic from your firewall provider.

Frequently asked questions

Is this check safe to run on my site?

Yes. It makes the same requests a visitor's browser would: your homepage over HTTPS, a check that plain HTTP redirects to HTTPS, and for WordPress sites the public RSS feed. It also looks up who owns your site's IP address and, for sites behind a firewall service, checks public DNS for common names (such as mail. or direct.) that point around it. It never connects to those addresses, and it does not try passwords, scan ports or send attack traffic.

Does this test my site for PHP2Shell directly?

No. Testing for the flaw directly means sending attack traffic to your server, which we will not do without your written permission. Instead, we combine what your server reveals with what your host and firewall provider have published. For a definitive answer, check your PHP version and build date from inside your site, or ask us to run an authorized test.

My host says it patched, and I am behind Cloudflare. Am I covered?

Probably, but confirm two things. First, that the patch applies to your plan: hosts usually exclude VPS and dedicated servers you manage yourself. Second, that your server only accepts traffic from Cloudflare; otherwise attackers can skip Cloudflare's rules by connecting to your server directly. If you are on PHP 8.1 or older, plan an upgrade even if your host has backported the fix.

Does updating WordPress or my plugins fix PHP2Shell?

No. The flaws are in PHP itself. WordPress automatic updates do not change the PHP version on your server. Your host, or whoever manages your server, has to install a fixed PHP build.

The result says "version hidden". Am I safe?

Not necessarily. Hiding the version is good practice, but the version behind it could still be out of date. Use the steps above to see the exact version, or ask us to check it for you.

My host says my old PHP version is patched. Is that possible?

Yes. Some Linux vendors and hosts (for example Ubuntu, Red Hat and CloudLinux) keep patching older PHP versions under the original version number. If your host tells you that, ask them to confirm it in writing, and plan an upgrade anyway, since plugins and themes stop supporting old PHP too.

Do you store the sites I check?

We keep the website address, a summary of the result, and basic details of the request (your IP address, its network and country, your browser type, and the page that linked you here) to prevent abuse and improve the tool. We do not publish results or share these details, and there are no shareable result pages.

What should I do if my PHP version is out of date?

Test your site on a supported PHP version in a staging copy first, update plugins and themes, then switch the live site. Most hosts let you change the PHP version in the control panel. If you would like help planning the upgrade or reviewing the rest of your site's security, we can help.

Want an expert to look deeper?

Our team can confirm your exact PHP and plugin versions, check whether your firewall can be bypassed, and test your site the way an attacker would.

Schedule Your Free Consultation