Question 1

How do I check if my website is affected by the PHP vulnerability?

Accepted Answer

Enter your domain at phpexposurecheck.com. The tool passively checks whether your site is exposed to the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) using publicly visible information. It never scans or contacts your site, and results take about 30 seconds.

Question 2

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

Accepted Answer

PHP2Shell is a pair of critical remote code execution flaws in PHP's core runtime, disclosed on 21 October 2026, that let an attacker take control of a web server without logging in. They affect most PHP versions and carry a severity score of 9.2 out of 10.

Question 3

Which PHP versions are affected and which are fixed?

Accepted Answer

PHP 5.4 through 8.5.11 are vulnerable. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are end of life and have no official fix.

Question 4

Does the tool scan my website?

Accepted Answer

No. The check is passive. It only reads information that is already publicly visible and never sends a scan, crawl or request to your site. Detailed results are released only to verified domain owners.

Question 5

Is the check free?

Accepted Answer

Yes. The PHP Exposure Check is a free tool from Global Tech Partners (GTP Cyber).