Cyber Security Services ยท Trusted by Fortune 100 enterprises, growing businesses, and MSPs since 2014
Enter your website address. We check what your server reveals about PHP, who hosts it, and whether a firewall such as Cloudflare sits in front, then match that against what your host and firewall provider have said about PHP2Shell.
We load your homepage once, the same way a browser does. No attacks, no logins, nothing installed. We keep a record of each check; see the FAQ below.
MSP or agency? Check up to 25 client sites at once with a free bulk check.
PHP2Shell is the name given to two flaws in PHP itself, the language that runs WordPress, Drupal, Joomla, Magento and many other sites. Both are rated 9.2 out of 10 (CVSS v4.0). Because the flaws are in PHP rather than in your website's code, updating WordPress or your plugins does not fix them. The PHP running on your server has to be updated.
PHP's own advisories credit researchers from three teams. Each published its own account, and they are the best sources for how the flaws work and how they were found.
Official advisories: php.net security advisory · CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) · CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) · The PHP Foundation's statement
From the outside, we can only see what your server chooses to reveal. If your server announces its PHP version, we compare it with the fixed releases. If it hides the version, which most well run servers do, nobody can confirm the fix from outside, including us. In that case we tell you what your host and your firewall provider have publicly said, and how to check the exact version yourself in about two minutes.
A host saying it has patched is good news, but it covers its platform, not necessarily your plan. Self-managed VPS and dedicated servers are usually excluded. A firewall such as Cloudflare can block known attack patterns, but only for traffic that passes through it, and it does not update PHP.
Log in to your dashboard and go to Tools, then Site Health, then the Info tab. Open the Server section. The PHP version is listed there. Site Health does not show the build date, so on hosts that patch in place, use your hosting panel.
In cPanel, open Select PHP Version or MultiPHP Manager. In Hostinger's hPanel, open PHP Info and look at the Build Date. On managed WordPress hosts such as Kinsta, WP Engine or SiteGround, look under the site's Tools or Settings page. If you can't find it, your host's support team can tell you in minutes.
If you have SSH access, run php -v; the first line shows the version and build date. The web server can use a different PHP than the command line, so confirm with your control panel too. After updating, restart PHP-FPM and the web server so the fixed version is actually running.
Avoid leaving a phpinfo() page on your site. If you create one to read the build date, delete it right away; it shows attackers far more than your PHP version.
Public statements as reviewed on Nov 9, 2026. Statements change quickly; follow the source link for the latest. "Says patched" is the provider's own claim, which we have not independently verified.
| Host | Status | What they said |
|---|---|---|
| Kinsta | Says patched | Kinsta says PHP security updates were rolled out across its platform for PHP 7.4 and 8.0 through 8.5 (resolved Oct 22, 2026, 08:26 UTC), and that Cloudflare firewall rules stay in place. No customer action required. Source |
| WP Engine | Says patched | WP Engine reports deployment finished on Oct 22, 2026, naming builds 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12. Flywheel, also part of WP Engine, reports its platform patched on Oct 21. Source |
| SiteGround | Says patched | SiteGround says it disabled the affected features on all supported PHP versions before the release, then applied the official fixes on Oct 21, 2026. No customer action required. Source |
| GoDaddy | Managed plans patched | GoDaddy says Managed WordPress (Oct 21), Windows Hosting and Web Hosting (Oct 22) are patched. On Web Hosting the version number may not change; a PHP build date of Oct 21, 2026 or later means patched. VPS customers must update PHP themselves. Source |
| Hostinger | Managed plans patched | Hostinger says the fix is installed on all hosting plans except VPS (Oct 22, 2026, 07:20 UTC), covering PHP 5.2 through 8.5. The version number may not change; a build date of Oct 21, 2026 or later in hPanel PHP Info means patched. VPS customers must update PHP themselves. Source |
| Bluehost / HostGator (Newfold) | Rolling out | Bluehost and HostGator said on Oct 23, 2026 that the majority of platforms are now up to date and patching continues, with mitigations covering a related issue (CVE-2026-115560) until PHP releases its fix. Managed hosting customers need no action. VPS and dedicated server customers must run a package update themselves. Source |
| WordPress.com / Pressable / WP VIP (Automattic) | Says protected | Automattic says sites on WordPress.com, WordPress VIP and WP Cloud (including Pressable) are protected. It does not name a PHP build. Source |
| Pantheon | Says patched | Pantheon reports live and pre-production environments patched on Oct 22, 2026, including its long-term-support builds of older PHP. Source |
| DreamHost | Says patched | DreamHost reports its network patched on Oct 22, 2026, with PHP 8.1 and older covered by mitigations. Source |
| Namecheap | Says patched | Namecheap reports its shared hosting patched through CloudLinux packages on Oct 22, 2026. Those builds keep the old version number. Source |
| Cloudways | Says patched | Cloudways reports all active servers running fixed PHP builds, including older versions, as of Oct 22, 2026. Source |
| Liquid Web | Rolling out | Liquid Web reported on Oct 29, 2026 (3:39 pm EDT) that the security updates have been rolled out across its hosting fleet and that it is still monitoring, with the incident not yet closed. Customers on end-of-life PHP 8.1 or older are urged to move to PHP 8.2 or newer. Source |
| Nexcess | Rolling out | Nexcess reported on Oct 29, 2026 (3:41 pm EDT) that the security updates have been rolled out across its hosting fleet and that it is still monitoring, with the incident not yet closed. Customers on end-of-life PHP 8.1 or older are urged to move to PHP 8.2 or newer. Source |
| InMotion Hosting | Rolling out | InMotion reported dedicated servers done, VPS in progress and shared hosting protected by mitigations on Oct 21, 2026. Source |
| A2 Hosting (hosting.com) | Managed plans patched | hosting.com reports cPanel and Plesk servers patched on Oct 22, 2026. Self-managed VPS is not covered. Source |
| Rocket.net | Rolling out | Rocket.net reported patches rolling out in waves for PHP 5.2 through 8.5 on Oct 22, 2026. Source |
| IONOS | No statement found | We did not find a public PHP2Shell statement from IONOS. Ask their support whether your plan runs a patched PHP build. |
| Pagely | No statement found | We did not find a public PHP2Shell statement from Pagely. Ask their support whether your site runs a patched PHP build. |
| Hetzner | You manage PHP | Hetzner patched its Webhosting and Managed Server products (Oct 21 to 22, 2026). On cloud and dedicated servers you rent, you manage PHP. Source |
| OVHcloud | You manage PHP | OVHcloud patched PHP 7.4 to 8.5 on its web hosting clusters (Oct 22, 2026), with older versions in progress. On VPS and dedicated servers, you manage PHP. Source |
| DigitalOcean | You manage PHP | DigitalOcean says Droplets and existing 1-Click apps must be updated by the customer; App Platform apps need a redeploy. Source |
| Amazon Web Services | You manage PHP | AWS says it cannot patch running Lightsail or EC2 servers; customers must update PHP or rebuild from updated blueprints. Elastic Beanstalk updates only with managed platform updates turned on. Source |
| Microsoft Azure | You manage PHP | Microsoft says built-in App Service Linux PHP images are being patched; custom containers and virtual machines are yours to update. Source |
| Google Cloud | You manage PHP | Google says App Engine standard, Cloud Run and Cloud Functions on PHP 8.2+ update automatically; virtual machines, GKE and custom images are yours to update. Some managed hosts also run on Google Cloud. Source |
| Provider | Status | What they said |
|---|---|---|
| Vercel | Firewall rules | Vercel added firewall rules on all projects. If you run a PHP runtime there, updating it is your job. Source |
| Cloudflare | Firewall rules | Cloudflare turned on PHP2Shell firewall rules by default for every plan with its WAF, including Free, from Oct 21, 2026, 03:02 UTC. Pro, Business and Enterprise customers should confirm the Cloudflare Managed Ruleset is deployed with these rules set to Block. Cloudflare reports attackers changing payloads to get around the rules and still says to patch PHP. Source |
| Akamai | Firewall rules | Akamai says App & API Protector customers are protected, and still says to patch PHP immediately. Source |
| Imperva | Firewall rules | Imperva says Cloud WAF customers are protected out of the box, and calls patching PHP the primary fix. Source |
| AWS WAF | Firewall rules | AWS updated its PHP managed rule group; sites pinned to an older rule version must move to the latest. AWS calls the WAF a stopgap, not a fix. Source |
| Amazon CloudFront | No statement found | CloudFront on its own is a content delivery network. It blocks PHP2Shell only if AWS WAF with the updated PHP rules is attached to it, which we cannot see from outside. Source |
| Azure Front Door | Firewall rules | Microsoft has published Azure WAF mitigation guidance for PHP2Shell. Whether it is applied depends on your WAF policy, which we cannot see from outside. Source |
| Fastly | Firewall rules | Fastly says Next-Gen WAF customers can turn on a signal covering both CVEs (Oct 21, 2026). It is not on by default, and Fastly calls it partial protection and urges patching. It applies only to sites using Fastly's Next-Gen WAF. Source |
| Sucuri | No statement found | We did not find a PHP2Shell-specific statement from Sucuri. Ask Sucuri support whether your firewall plan blocks it. |
Source: the PHP project's supported versions page (php.net). Dates update automatically.
| Version | Status today | Security fixes end | Latest release |
|---|---|---|---|
| PHP 8.5 | Active support | Dec 31, 2029 | 8.5.12 |
| PHP 8.4 | Active support | Dec 31, 2028 | 8.4.27 |
| PHP 8.3 | Security fixes only | Dec 31, 2027 | 8.3.36 |
| PHP 8.2 | Security fixes only | Dec 31, 2026 | 8.2.35 |
| PHP 8.1 | End of life | Dec 31, 2025 | 8.1.34 |
| PHP 8.0 | End of life | Nov 26, 2023 | 8.0.30 |
| PHP 7.4 | End of life | Nov 28, 2022 | 7.4.33 |
| PHP 7.3 | End of life | Dec 6, 2021 | 7.3.33 |
| PHP 7.2 | End of life | Nov 30, 2020 | 7.2.34 |
| PHP 7.1 | End of life | Dec 1, 2019 | 7.1.33 |
| PHP 7.0 | End of life | Jan 10, 2019 | 7.0.33 |
A content delivery network or web application firewall, such as Cloudflare, Sucuri, Imperva or Akamai, sits between visitors and your web server. It can block common attacks and hide your server's real address. Our check shows which of these, if any, your site sits behind, so you know where your protection starts.
A firewall does not update PHP. It filters known attack patterns, but your server still runs the same code. And if your server's real address can be reached directly, attackers can go around the firewall entirely. Ask your host to make sure your server only accepts traffic from your firewall provider.
Yes. It makes the same requests a visitor's browser would: your homepage over HTTPS, a check that plain HTTP redirects to HTTPS, your public robots.txt file, your /index.php address, and for WordPress sites the public RSS feed. It also looks up who owns your site's IP address and, for sites behind a firewall service, checks public DNS for common names (such as mail. or direct.) that point around it. It never connects to those addresses, and it does not try passwords, scan ports or send attack traffic.
Two public sources anyone can search, looked up without contacting your site. The Wayback Machine keeps saved copies of websites, including what the server said about its software at the time. Shodan scans the whole internet every week and lists the open services and software it finds on each address; attackers use it to pick targets, so it is worth knowing what it shows about you. Shodan's record for an address behind a firewall service describes that service, not your server, so we only look up addresses that belong to you.
No. Testing for the flaw directly means sending attack traffic to your server, which we will not do without your written permission. Instead, we combine what your server reveals with what your host and firewall provider have published. For a definitive answer, check your PHP version and build date from inside your site, or ask us to run an authorized test.
Probably, but confirm two things. First, that the patch applies to your plan: hosts usually exclude VPS and dedicated servers you manage yourself. Second, that your server only accepts traffic from Cloudflare; otherwise attackers can skip Cloudflare's rules by connecting to your server directly. If you are on PHP 8.1 or older, plan an upgrade even if your host has backported the fix.
No. The flaws are in PHP itself. WordPress automatic updates do not change the PHP version on your server. Your host, or whoever manages your server, has to install a fixed PHP build.
Not necessarily. Hiding the version is good practice, but the version behind it could still be out of date. Use the steps above to see the exact version, or ask us to check it for you.
Yes. Some Linux vendors and hosts (for example Ubuntu, Red Hat and CloudLinux) keep patching older PHP versions under the original version number. If your host tells you that, ask them to confirm it in writing, and plan an upgrade anyway, since plugins and themes stop supporting old PHP too.
We keep the website address, a summary of the result, and basic details of the request (your IP address, its network and country, your browser type, and the page that linked you here) to prevent abuse and improve the tool. We do not publish results or share these details, and there are no shareable result pages.
example.com and www.example.com are two separate addresses, and each can answer on plain HTTP and on HTTPS. A common setup sends http://example.com to http://www.example.com, and only then to https://www.example.com. That middle step travels unencrypted, so the best practice is to redirect every version straight to the HTTPS address you prefer. Some sites also let the bare address and the www address behave differently, for example one blocks automated checks and the other does not; when that happens we tell you what we could and could not confirm. If your domain is on the HSTS preload list, Chrome, Edge, Firefox and Safari switch to HTTPS before sending anything, so visitors are protected either way and the result says so.
We email you that one report, with a branded PDF report card attached, from sales@cybersecurityservices.com, and our team sees your name, email address and the site you checked so we can follow up once about it. We do not add you to a mailing list. If you also tick "Also watch", we re-check that site once a week and email you only when its grade or PHP2Shell status changes; watching starts only after you press Confirm, and every watch email has a one-click unsubscribe.
When a company your staff use is breached, the stolen email addresses and passwords are often sold or shared on the dark web, and attackers try them against your email and other accounts. On request, our team searches breach and dark web data sources for accounts at your domain and walks you through what we find. It only searches existing data and never touches your systems. Because the results can include employee passwords, you must use an email address at the domain, accept our authorization and confidentiality terms, and confirm the request from your inbox. We share results only with you, mask passwords, and delete results within 30 days unless you ask us to help further. Request a scan.
Test your site on a supported PHP version in a staging copy first, update plugins and themes, then switch the live site. Most hosts let you change the PHP version in the control panel. If you would like help planning the upgrade or reviewing the rest of your site's security, we can help.
Our team can confirm your exact PHP and plugin versions, check whether your firewall can be bypassed, and test your site the way an attacker would.
Schedule Your Free Consultation
Network, web app, API, cloud and red team testing
24/7 managed detection and response
Fractional security leadership and board reporting
Continuous scanning, prioritization and fix tracking
Containment, forensics, recovery and retainers
Secure AI tools, LLM apps and sensitive data
Strategy, assessments and hands-on remediation
Protection for family offices and private wealth
K-12 and higher education security and compliance
HIPAA risk analysis, testing and monitoring
Security programs for state and local agencies
OT, supply chain and CMMC readiness
GLBA, SEC and FINRA cybersecurity programs
SOC 2, application testing and customer security reviews
Protect client confidentiality and stop wire fraud