PHP2Shell Vulnerability Checker

Checks public response headers for a disclosed PHP version and compares it with known upstream fixed releases for CVE-2026-109618 and CVE-2026-109619. It does not exploit the target.

Only public HTTP/HTTPS hosts on ports 80 and 443 are accepted. Requests are limited by timeout and response size.

How to interpret results

Potentially vulnerable: a disclosed version is older than the listed upstream fixed version, or is on an older branch requiring vendor verification.
Not detected: the disclosed version is at or above the listed upstream fixed version. This is not proof that the web-serving runtime is patched.
Inconclusive: no parseable PHP version was disclosed or the request could not be checked.

Important: a URL-only check cannot confirm exploitability, detect vendor backports reliably, or prove that a site is uncompromised. Do not use this result as a substitute for checking the actual web-serving PHP package and vendor advisory.