PHP2Shell · Critical PHP security update21 OCT 2026
Read advisory ↗
HOG3 RESEARCH / EXPOSURE CHECK 001

Your PHP.
Under the
spotlight.

See which PHP version your website advertises, whether it is affected by PHP2Shell, and exactly what to update.

Free to useNo signupNo exploit probes
THE EXPOSURE SURFACEREQUEST → RUNTIME
HTTP requestPHP runtimeYour app

Vulnerable paths can run before your application code.

PHP2SHELL / WEBSITE CHECKREADY

Check your website.

Paste a page address. In a few seconds you will see the PHP version it advertises and what to do next.

Use a page that runs PHP, like /index.php. We add https:// if you leave it out.

We keep a record of who runs each check. No marketing unless you tick the box below.

NO EXPLOIT PROBES5 CHECKS / 10 MIN
Header checks only; no exploit probes. Verify your installed PHP package to confirm patch status.
Two CVEs. One priority.
Update your PHP runtime.Application updates alone won't fix PHP core.
CVE-2026-109618
Out-of-memory corruptionRequest cleanup / RCE
CVE-2026-109619
Stale global stateWorker state reuse / RCE
Security releases
Available now ↗Published 21 October 2026
01 / THE METHOD

Less guessing.
More evidence.

A focused external check of the URL you provide, with the limits made clear at every step.

01 / OBSERVE

Find the PHP fingerprint.

Read the Server and X-Powered-By response headers. If the server advertises a PHP version, compare it with the fixed upstream releases.

02 / COMPARE

Compare with fixed releases.

Compare the advertised version with the last vulnerable release for its PHP branch. The check uses HEAD and falls back to GET only if HEAD is unsupported.

03 / ACT

Make the next move.

Get an OK, VULNERABLE, or UNKNOWN result with version evidence and a practical next step. Hidden headers or unknown versions leave patch status unconfirmed.

02 / THE FIX

Patch the runtime.
Close the exposure.

Upgrade every web-serving PHP runtime and restart its workers. These are the first fixed upstream releases for the supported branches.

Read PHP's security advisory
BranchFirst fixed releaseStatus
PHP 8.58.5.12PATCH AVAILABLE
PHP 8.48.4.27PATCH AVAILABLE
PHP 8.38.3.36PATCH AVAILABLE
PHP 8.28.2.35PATCH AVAILABLE

Vendor backports may retain an older version number. Verify your package advisory. For PHP 8.1 and older, consult your vendor or upgrade to a supported branch.

03 / BEFORE YOU CHECK

A little context.
No false certainty.

What do the results mean?

OK: the PHP version your site advertises is newer than the last vulnerable release for its branch. VULNERABLE: the advertised version is at or below that release, so update it. UNKNOWN: your site does not advertise a PHP version this check recognizes, because the headers are hidden, the address redirects, or it runs a development build or another branch, so the check cannot tell.

Does a clear result mean my site is safe?

No. Headers can be hidden or inaccurate, and vendor packages may backport fixes. This check does not test whether either CVE is exploitable. Verify the PHP package running in every web worker against the upstream or vendor advisory.

Will this affect my website?

The checker sends a HEAD request. It falls back to GET only for HTTP 405 or 501. It sends no form payloads, follows no redirects, and does not attempt exploitation. Only check systems you own or are authorized to assess.

What if a firewall blocks the check?

If no usable PHP version is exposed, the result is UNKNOWN. A firewall response does not establish that PHP behind it is patched. Redirects are not followed: submit the final PHP URL for the most useful result.

What data does HOG3 keep?

Your email, with the hostname, result, and time of each check you run, is kept for up to 12 months to record who ran it and to follow up on abuse. Addresses are not verified. HOG3 sends updates only if you tick the optional box and then confirm your address from a confirmation email.

A check log records the client IP, target hostname, result, and timestamp; the hosted checker keeps it for up to seven days. Full paths and query strings are not written to that log.

Results are kept for at most an hour; the hosted checker at php2shell.hog3.com returns them without storing them. The report you download includes the full address you checked, so avoid secrets in submitted URLs.

Can configuration changes replace the update?

No. PHP states that only updating provides a complete fix. Configuration measures reduce exposure to particular paths. Follow the current PHP advisory, apply the security update, and restart the affected workers.

One check is a starting point.

Keep testing the rest of your attack surface with HOG3.

Explore autonomous pentesting