PHP version checker: is your site patched for PHP2Shell?
On Oct 21, 2026, PHP fixed two critical remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell"). Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. What happened and what to do →
Free. Only for domains you own. We never run the exploit, never send attack traffic, and never publish your result.
1. Enter a domain you own
2. Prove you own the domain
Do one of these. Your token is valid for 24 hours.
Option A: DNS TXT record on (or ) with the value:
Option B: File at containing only:
3. Check the announced PHP version
Verified for 30 days. We'll make one normal request to your homepage (two if it redirects to www) and read only the version your server announces.
Get PHP patch alerts by email
Get a note when there's a new critical PHP fix. (Stored only; you can ask us to remove it anytime.)
Other ways to check your PHP version
- Your hosting control panel (cPanel, Plesk or your host's dashboard).
php -von the server.- The build date in a private phpinfo() page. Hosts that backport the fix may keep the old number; GoDaddy says a fixed site can show 8.5.11.[GoDaddy]
More in how to check your PHP version and what to ask your host.
By Keith Motte, Topofmind.AI, former AWS Enterprise Support Manager who ran about 20 end-of-life and patch campaigns for healthcare customers. Last updated Oct 22, 2026.