Is your WordPress site vulnerable to PHP2Shell?
Answer three questions and this free checker tells you whether your PHP is patched against CVE-2026-109618 and CVE-2026-109619. It runs entirely in your browser — the version you type never leaves your device.
Fixed PHP: 8.5.12, 8.4.27, 8.3.36, 8.2.35 · released Oct 21, 2026 · facts checked Oct 23, 2026
Interactive checker
Am I affected by PHP2Shell?
Runs in your browser · nothing is sent
- 1. PHP version
- 2. Server API
- 3. Hosting
- 4. Verdict
Find your exact PHP version
The checker is only as good as the version you give it. Here are three ways to read the PHP that is actually serving your site — the one that matters.
1. From wp-admin (easiest)
Open Tools → Site Health → Info → Server and copy the PHP version value. This is the version answering web requests, which is exactly what the checker needs.
2. Over SSH (if you have shell access)
Handy on a VPS, but note the command-line PHP can differ from the web one — compare it with Site Health if they disagree.
$ php -v# and the version each pool/handler uses:$ php-fpm8.3 -v # or apache2ctl -M | grep php3. From the response headers (no login needed)
Some servers advertise PHP in the X-Powered-By or Server header. Many hide it — a blank result here means nothing, so fall back to Site Health.
$ curl -sI https://example.com | grep -iE '^(server|x-powered-by):'Checking many sites or need the version the server really runs (not just what it advertises)? A quick command-line check over SSH and your host's package manager are the authoritative sources — see how to check and update your PHP version.
One trap: the version number can lie
Debian, Ubuntu, Red Hat and many hosts backport security fixes without bumping the headline version. A site reporting 8.3.6 on Ubuntu 24.04 can be fully patched, while a hand-built 8.3.6 is not. So:
- → A green result means the upstream number is safe — still confirm the workers restarted.
- → A red result on a managed or distro-packaged server may still be patched by a backport. Check your package version against your host's or distro's advisory before you panic.
- → Not sure who patches your PHP? Our guide on whether your WordPress host is patched has a copy-paste email to ask them.
The only site that passes this checker by design
Presscomet is the WordPress admin, block editor, themes and REST API rebuilt without the PHP runtime. There is no PHP process to exploit, so PHP2Shell — and the next PHP runtime bug — simply doesn't apply.
| For this bug | Classic WordPress | Presscomet |
|---|---|---|
| PHP runtime bugs (PHP2Shell) | Patch PHP and restart workers | Not present — no PHP runtime |
| Who has to act | You or your host, fast | Nothing to patch for this bug |
| PHP plugin vulnerabilities | Every active plugin runs on each request | PHP plugins don't run |
| Public page requests | PHP on every cache miss | Static HTML from the cache |
| Still your job | Updates, passwords, 2FA, backups | Updates, passwords, 2FA, backups |
Honest limits: Presscomet runs on Node.js and its own code, which have advisories of their own and need updating; it has no built-in web application firewall or malware scanner, and it doesn't run WooCommerce or PHP plugins. See the full picture on WordPress security and Presscomet vs WordPress.
PHP2Shell checker, explained.
What does the PHP2Shell checker do?
It compares the PHP version your site reports against the first fixed releases for CVE-2026-109618 and CVE-2026-109619 — 8.5.12, 8.4.27, 8.3.36, 8.2.35 — and factors in how your server runs PHP and where it is hosted. It runs entirely in your browser; the version you type is never sent anywhere.
Is the checker accurate?
It is a first read, not a scan. A version number alone can't see inside your server, and Linux distributions and some hosts backport the fix without changing the version number (Ubuntu 24.04's patched build still reports 8.3.6). Treat a red result as 'confirm with your host' and a green result as 'confirm PHP workers were actually restarted'. Your host's or distro's advisory is the final word.
Where do I find my PHP version?
In wp-admin go to Tools → Site Health → Info → Server and copy the 'PHP version' value — that is the PHP actually serving your site. You can also run php -v over SSH, but the command-line version can differ from the one answering web requests.
The checker says I'm patched. Am I safe?
Only once the PHP workers restarted. Updating the PHP package doesn't change the running process until php-fpm, Apache or LiteSpeed is restarted (or the container recreated). Re-check Site Health after restarting. And if your site was online and unpatched between 17 and 21 October 2026, run the compromise checklist regardless.
WordPress and all my plugins are up to date. Does that fix PHP2Shell?
No. PHP2Shell is a flaw in the PHP runtime underneath WordPress, not in WordPress, a plugin or a theme. Only updating PHP itself (or your host doing it for you) closes it. Updating WordPress is still worth doing — it just doesn't address this bug.
Can Presscomet be hit by PHP2Shell?
No — Presscomet has no PHP runtime, so this entire class of bug doesn't apply. That isn't the same as 'unhackable': it runs on Node.js and its own code, which get security advisories and need updating like any software, and you still need strong passwords, two-factor login and backups.
Same WordPress.
No PHP to patch.
Check your site from the browser, then move it with the wizard. Free, open source, and your live site is never touched.
Free · Open source · Export to WXR whenever you like