Free PHP2Shell Checker: Check Your Site and Set Up BlackSight

We built this checker for website owners who need a quick answer to a practical question: does the PHP version my website advertises fall in the affected PHP2Shell range? The tool checks for version evidence related to CVE-2026-109618 and CVE-2026-109619, without requiring an account.

Check your website for PHP2Shell

How to use the free PHP2Shell checker

1. Open the BlackSight PHP2Shell checker.
2. Enter a public domain or URL for a website you own or have permission to assess.
3. Select Check for PHP2Shell. The check usually takes a few seconds.
4. Read the result and expand View the response evidence to see the HTTP and HTTPS observations.
5. Follow the remediation plan or select Check another website to repeat the process.

The checker makes ordinary HTTP and HTTPS requests to the homepage and reads response headers. It ignores paths and query strings in your submitted URL. It does not submit exploit payloads or start a full vulnerability scan. Rate limits apply.

We record the checked domain, your source IP, and the outcome, and email the result to the BlackSight team. Submitted paths, queries, credentials, and cookie values are not retained in the checker record. See our privacy policy.

What does my PHP2Shell result mean?

Affected by PHP2Shell

A red banner means an observed PHP version falls in the affected upstream range. For example, PHP 8.2.27 predates the 8.2.35 fix. Ask your host to update PHP or document a vendor-backported fix. This does not establish that the site was compromised.

Reported version includes the fixes

The disclosed stable PHP version meets the fixed release for its branch. Confirm the actual deployed package and every running instance with your host.

We couldn't determine your PHP version

The headers did not provide a version we could assess. PHP may be hidden behind a CDN, proxy, or server configuration. Ask your provider to check the runtime directly.

We couldn't reach this website

Neither connection provided usable response headers. Check the domain and availability, then try again. DNS, TLS, or firewall restrictions can also prevent a result.

Headers can be stale or modified, and different servers can run different PHP builds. Treat every outcome as version evidence. An unknown result is not an all-clear, and a reported fixed version does not certify the security of the whole website.

What to do if your PHP version is affected

PHP's October 21 security advisory identifies PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as the first fixed releases. Install a supported release containing both fixes, or the package your vendor confirms includes them. Older unsupported branches need a supported upgrade or a confirmed vendor fix.

1. Confirm the PHP runtime serving web requests, including its package or container build.
2. Apply the fixed release and restart or replace the relevant PHP workers on every instance.
3. Verify the deployed build, test your application, and rerun the public version check if headers are available.
4. Review logs and investigate suspicious activity; patching does not remove an existing compromise.

Updating WordPress, plugins, or themes does not update the server's PHP runtime. For hosting support, ask: “Please confirm that the PHP runtime serving my website includes fixes for CVE-2026-109618 and CVE-2026-109619, and that old workers have been replaced.” Our detailed PHP2Shell patching guide covers common hosting and operating-system setups.

How to set up BlackSight for ongoing website security scans

After checking PHP, create a scanner account to keep reviewing your website's exposed security findings. The standalone checker does not create a dashboard report or a recurring PHP2Shell scan; configure your ongoing checks separately.

1. Create your account. Go to Get started on scanner.blacksight.io and complete account and organization setup. You can start on the Free plan without a credit card.
2. Add and verify your website. Follow the domain verification instructions in your organization. Use the exact DNS TXT value shown, or the provided file at /.well-known/blacksight-domain-association. Complete verification before configuring recurring scans.
3. Choose your scans. Open scan configuration and select the relevant available types, such as SSL, security headers, CMS, and web scanning. Run an initial scan of your verified website. Technology scanning is available on paid plans and can help review exposed software information.
4. Review reports and fix findings. Prioritize the reported issues, confirm changes with your hosting or development team, and re-scan when your plan allowance permits. Keep PHP package verification part of this process.
5. Configure recurring checks. Choose a schedule supported by your plan and review new reports regularly. The Free plan includes limited scan types, one instant scan per month and one scheduled scan per quarter per supported scan type, with 30-day report history. See current plans for additional types and frequency.

Scanning complements runtime patching. It does not install PHP updates or certify that PHP2Shell remediation is complete. For help interpreting evidence, planning remediation, or arranging a manual assessment, email contact@blacksight.io, call +1 615-200-7888, or contact BlackSight.

Set up your free BlackSight account

Frequently asked questions

How do I check my website for PHP2Shell for free?

Open scanner.blacksight.io/php2shell-checker, enter your website, and select Check for PHP2Shell. No account is required. BlackSight reads public HTTP and HTTPS response headers, compares disclosed PHP versions with the fixed releases, and shows the result with remediation guidance.

What does Affected by PHP2Shell mean?

The checker observed a PHP version in the affected upstream range for CVE-2026-109618 and CVE-2026-109619. Update the web-serving runtime or confirm a vendor-backported fix with your host. The result is version evidence, not proof of exploitation or compromise.

What if the checker cannot detect my PHP version?

Ask your hosting provider or administrator to confirm the PHP version and package patch status used for web requests. A hidden header, CDN, or unreachable website can prevent detection. An unknown result does not mean that PHP is absent or that the website is safe.

Do I need a BlackSight account to use the PHP2Shell checker?

No. The public checker is free without an account. Create a BlackSight account separately to verify your domain, run the scans included in your plan, review reports, and configure recurring scanning. The standalone PHP2Shell check does not create a dashboard scan or recurring schedule.

Does setting up the scanner fix PHP2Shell?

No. Your host or administrator must update the PHP runtime and restart or replace old workers. BlackSight's scanner helps review externally observable security findings over time. Technology scanning requires a paid plan, and no external scan alone certifies that PHP2Shell has been patched.