How to test your website for PHP2Shell safely

WindowsMacUpdated

The PHP project's advisory of 21 October 2026 lists the PHP versions that fix PHP2Shell: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. That list is the test. If your site's PHP version is at or above the fix for its branch, the update the advisory asks for is in place. This guide is accurate as of 23 October 2026.

Quick answer

Check your site's PHP version against the fixed releases, read any notice from your host or from the makers of software you run, and look up bundled products on the NCSC-NL list on GitHub. A scanner can't replace that. The advisory's fix is updating, and you should only ever test sites you own or have permission to test.

What do the official sources say to check?

None of the official advisories for PHP2Shell tells personal users to run a scanner. The PHP advisory says the flaws affect all PHP installations serving web requests and that only an update is a complete solution. The UK's National Cyber Security Centre (NCSC) tells organisations to find where they run PHP, update, and keep watching for updates from vendors whose products bundle PHP. The US agency CISA says to inventory every system running any version of PHP and patch to the fixed releases.

For someone with a blog, a small shop or a club site, that comes down to two checks: the version your site runs, and the notices from the companies whose software or hosting you rely on.

How do I check my PHP version?

You need the exact number your site runs on, such as 8.3.36, not just "PHP 8". Our guide on how to check your website's PHP version shows where to find it in WordPress and in a hosting panel, and what to ask your host if you can't see it.

The NCSC adds one warning that matters here: "do not limit discovery to outdated PHP versions". Its advice says organisations using any version of PHP are affected, so a recent-looking version still needs comparing against the fixed list.

What about notices from my host and other vendors?

Your host runs the server, so its notice is often the clearest answer you'll get. Look for an email, a status page or a support article about the 21 October PHP advisory, and check that it names the fixed version for the branch your site uses. If there's nothing, ask.

PHP can also sit inside other products. CISA says PHP "is often a component of other software" and its presence "may not be directly observable". The NCSC tells organisations to monitor for security updates from third-party vendors, since appliances and services may bundle PHP. If you run a NAS drive or a router with a web admin page, the maker's own security advisory is the place to look. Our guide to PHP2Shell on Synology and QNAP covers what those two have said.

What is the NCSC-NL list on GitHub?

The Dutch National Cyber Security Centre (NCSC-NL) keeps a public repository at github.com/NCSC-NL/php2shell. The UK NCSC's PHP2Shell page says NCSC-NL has published an inventory of software products with a potentially affected PHP dependency.

The repository describes itself as operational information about CVE-2026-109618 and CVE-2026-109619. It has three parts: inventory lists of software products with a PHP dependency potentially affected by the flaws, detection and mitigation material, and tools for generating the files in the repository. Its table of latest updates shows the date, supplier, product, version, a status for the two flaws, and links. The statuses shown include Fix, Vulnerable and Investigation. The README says it's being updated as the situation develops.

To use it, look up the products you run by supplier and product name, then follow the link to that supplier's own advisory for the detail. The README doesn't describe the list as complete, so a product being missing doesn't mean it's unaffected.

Can an online PHP vulnerability scanner tell me if I'm safe?

It can tell you some things, with limits. The NCSC's general guidance on vulnerability scanning says infrastructure scanners work by "fingerprinting" or "banner grabbing", collecting details about a system and comparing them against known vulnerable products. It says automated scanning cannot compare with manual processes such as penetration testing, that network scanners aim for breadth rather than depth, and that scanners can produce false positives, where a vulnerability is reported that doesn't exist, and false negatives, where a real one is missed.

For PHP2Shell, a scanner isn't part of the PHP project's advice, and the advisory's own fix is updating. Whatever a scan says, what you still need to know is the exact PHP version on your server and whether it's at the fixed release. If a scanner and your host disagree, ask your host to confirm the version in writing.

Only test sites you own or have clear permission to test, and never run exploit code against anyone else's site. Section 1 of the UK's Computer Misuse Act 1990 makes it an offence to cause a computer to perform any function with intent to secure access to any program or data held in any computer, where that access is unauthorised and the person knows it is. On conviction on indictment, the maximum is two years' imprisonment, a fine, or both.

If your site sits on a hosting company's server, ask them before running anything beyond a version check.

More questions

Is there an official PHP2Shell scanner?

None of the official pages listed below offers a scanner for personal users. The NCSC-NL repository contains detection and mitigation material, but its README doesn't describe a scanner. The PHP advisory's answer is to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Has PHP2Shell been exploited?

As of 23 October 2026, CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". CERT-EU says early proofs of concept have begun to circulate, and QNAP's advisory says exploitation attempts against PHP have been publicly reported.

My scan says my site is vulnerable. What now?

Check your PHP version against the fixed list and ask your host to confirm it. If it isn't fixed, update or ask your host to. If something looks wrong on the site itself, our guide on what to do if your website is hacked covers the first hour.

My host says it's patched but a scanner disagrees. Who's right?

Scanners can report false positives, according to the NCSC's scanning guidance, and the PHP version on your server is what the advisory's fix depends on. Ask your host for the exact version your site runs and compare it with the fixed releases yourself.

Does a firewall fix PHP2Shell?

CISA says a web application firewall may provide some protection until systems are updated or patched. The PHP advisory says its temporary measures reduce exposure but "do not make an installation safe". Updating is still the fix.

Sources