What we check
- One HEAD request, the same kind of request a browser makes for headers.
ServerandX-Powered-By, looking for a PHP version banner.- A short GET of
/wp-json/to see if WordPress answers. The body is capped at 2KB.
Free passive check
Is your site affected by PHP2Shell?
See the PHP version your server already advertises, and whether that version includes the October 2026 fix. The check is one normal request. Nothing is exploited.
- Headers only
- Public sites
- No account
One HEAD request, then a short read of /wp-json/ if the site answers. Nothing else is sent.
What this check does
What we don’t
- No exploit payloads, uploads, logins, or anything meant to trigger the bug.
- Not a confirmed test, and not a statement that a site has been compromised.
- Linux distributions often backport the fix and leave the version string unchanged, so a “vulnerable” banner can overstate exposure.
PHP2Shell, briefly
PHP2Shell is the name for two PHP vulnerabilities disclosed on 21 October 2026: CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution on PHP that serves web requests. The PHP project shipped fixed releases the same day.
PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35
PHP 8.1 and older are out of upstream support. Those branches do not get an official point release for this issue, so they need an upgrade to a supported branch, or a vendor that backports the fix.