ThreatMon
PHP2Shell Vulnerability Check
Check whether a public site runs a PHP version exposed to PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Enter a hostname to see whether its advertised PHP version is vulnerable, patched, or hidden — one read-only request, response headers only.
< branch fix
Affected Versions
CVSS 9.2
CVE-2026-109618
CVSS 9.2
CVE-2026-109619
Read-only
Detection Method
Free
No Account Needed
#PHP2Shell#PreAuthRCE#CVE-2026-109618
Runs only when you press Enter — nothing is queried while you type.
Fixed PHP versions
BranchSupport statusFixed version
8.5Active8.5.12
8.4Active8.4.27
8.3Security fixes8.3.36
8.2Security fixes (EOL 2026-12-31)8.2.35
8.1 and olderEnd of lifeNo official fix. Source backports for 7.4, 8.0, 8.1
Version-based detection only. A verdict reflects the PHP build advertised in HTTP response headers, not an exploit attempt: a hidden version returns Inconclusive, not Safe, and distribution packages (e.g. PHP/8.1.2-1ubuntu2.19) often backport security fixes without changing the version string, so a Vulnerable verdict on a distro-packaged PHP can be a false positive — confirm against the vendor changelog. This tool sends no PHP2Shell payloads and performs no intrusive testing.
Action Center
What You Need to Know
Understand the Check
PHP2Shell Vulnerability Check reads the PHP version a public site advertises in its HTTP response headers (X-Powered-By / Server) and compares it with the fixed release of that branch for CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, pre-authentication remote code execution). Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; 8.1 and older are end-of-life with no official fix.
The check is read-only: one HTTP request per redirect hop, response headers only. No payload is sent, nothing is written, and the target is never exploited. A hidden version returns Inconclusive — not Safe.
Why It Matters
Left on a version below the fix, every PHP endpoint on the host is exposed to:
Pre-authentication remote code execution — no credentials needed
Full compromise of the web application and the data behind it
Use of the server as a foothold into the rest of the network
Automated mass exploitation once public exploit code circulates
Take Action
ThreatMon recommends:
Updating PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later
Migrating off end-of-life branches (8.1 and older), or applying the source backports for 7.4 / 8.0 / 8.1 until you can
Checking distro-packaged PHP against the vendor changelog — backported fixes keep the old version string
Hiding the version banner (expose_php = Off) as hygiene, remembering that hiding is not patching
ThreatMon Intelligence
ThreatMon's platform extends this check into continuous monitoring, so newly disclosed PHP and web-stack CVEs are caught across your assets before they're exploited. Our intelligence surfaces:
Continuous CVE and exposure monitoring
Asset-wide vulnerability correlation
Actionable, prioritized remediation guidance
Read ThreatMon Threat Intelligence