What happens
Crafted web requests can run foreign code on the web server without logging in. An attacker can then change your website, read data or send emails.
Critical PHP flaw PHP2Shell · 21 Oct 2026
Which PHP version is your website running?
The critical PHP vulnerability PHP2Shell has been public since 21 October 2026. This check shows in seconds which PHP version your website reveals, whether it still gets updates and what you should do now.
- Free, no sign-up
- Public pages only, no attacks
- Honest about what cannot be seen from outside
- PHP
- X-Powered-By
- WordPress
- Plugins
- PHP2Shell
Check your website now
Enter your website’s domain or address. You will see the result right here.
Privacy: we only fetch public pages of your website and do not keep the domain or the result. Your IP address is briefly used as a checksum against abuse.
The check only reads what your server shows on its own. It does not replace information from your hosting provider.
Result based on the publicly visible identifier. Hosting providers and Linux distributions often install fixes without changing the version number. Only your hosting provider’s answer is binding.
What we found
Good to know
And your emails?
A hijacked web server sends phishing in your name. Check right away whether your domain is protected against forged senders.
Addresses we fetched
How to check the version yourself
These ways show the PHP version your website really uses.
How to check the version yourselfPHP2Shell
What happened on 21 October 2026
The PHP project closed two critical flaws in the PHP core: CVE-2026-109618 and CVE-2026-109619, severity CVSS 9.2 out of 10. Security firms are already reporting attacks.
Who is affected
Every PHP installation that answers web requests: WordPress, Joomla, online shops, contact forms and custom PHP applications.
What to do now
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and have PHP restarted. On PHP 8.1 or older, move to a supported branch.
Source: php.net, security advisory of 21 Oct 2026
Transparency
What the check does and does not do
We only check what any visitor of your website can see, and fetch at most 14 addresses.
What we check
- Home page headers“X-Powered-By” and “Server” often reveal the PHP version, for example PHP/8.3.12.
- Pages without cacheIf a cache swallows the header, we check the home page with a random parameter, a missing page (404) and the www address.
- WordPress and other systemsWe recognise WordPress, Drupal, Joomla, TYPO3, shops and other PHP systems by typical traces. For WordPress also the login page, API and feed.
- Minimum version from pluginsPlugins and themes linked from your home page state “Requires PHP”. That gives a lower bound, such as “at least PHP 7.4”.
- Support and PHP2ShellWe compare the number with the life cycle published by php.net and the fixes of 21 Oct 2026.
What we deliberately do not do
- No logins, no forms, no passwords
- No attacks and no deliberately triggered errors
- No guessing of paths such as phpinfo.php or admin pages
- No third-party or search engine data
- Your robots.txt is respected
Why the result is not binding
The check only sees what your server reveals voluntarily. Well-configured servers hide the PHP version. Then we show “not visible”, even though PHP is running.
A visible number can mislead: it may come from a proxy, be deliberately wrong or come from a Linux distribution such as Ubuntu or Debian that installs fixes without a new number.
Only what your hosting panel or WordPress shows under “Site Health” is binding. Use the check as a hint, not as proof.
PHP versions and their support
As of 21 Oct 2026. After end of life there are no more security updates.
| Branch | Status | Active support until | Security updates until | PHP2Shell fixed from |
|---|---|---|---|---|
| PHP 8.5 | Active | 31 Dec 2027 | 31 Dec 2029 | 8.5.12 |
| PHP 8.4 | Active | 31 Dec 2026 | 31 Dec 2028 | 8.4.27 |
| PHP 8.3 | Security only | 31 Dec 2025 | 31 Dec 2027 | 8.3.36 |
| PHP 8.2 | Security only | 31 Dec 2024 | 31 Dec 2026 | 8.2.35 |
| PHP 8.1 | End of life | 25 Nov 2023 | 31 Dec 2025 | no official update |
| PHP 8.0 | End of life | 26 Nov 2022 | 26 Nov 2023 | no official update |
| PHP 7.4 | End of life | 28 Nov 2021 | 28 Nov 2022 | no official update |
Source: php.net (Supported Versions, Unsupported Branches, security advisory of 21 Oct 2026)
Know for sure
How to check the version yourself
These ways show the PHP version your website really uses.
WordPress
Tools → Site Health → Info → Server. It shows the PHP version and extensions.
Hosting panel
In your provider’s panel (e.g. cPanel or Plesk), look at the PHP version of this very website, not just the server default.
Ask your provider
Ask specifically: “Is the PHP fix of 21 Oct 2026 (CVE-2026-109618 and -109619) installed on our website?”
Hide the version
With expose_php = Off the number disappears from the headers. It closes no flaw, but makes targeted attacks harder.
Step 2: email protection
Hijacked web servers send phishing in your name
Whoever takes over your web server can send emails with your domain as the sender. DMARC, SPF and DKIM make sure such forgeries are rejected. Check your domain for free.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
Questions about the PHP check
Is the PHP check really free?
Yes, no sign-up and no credit card. We only fetch public pages of your website, just like a normal visitor.
Why does the check say “version not visible”?
Many hosting providers hide the PHP version, and that is a good thing. The check then shows whether PHP is running and, for WordPress, which minimum version is needed. Your hosting panel shows the exact version.
Is my website safe if the check reports “fix included”?
Not necessarily. The check only rates the visible PHP version. Plugins, themes, passwords and other software can have their own flaws.
What is PHP2Shell?
Two critical flaws in the PHP core (CVE-2026-109618 and CVE-2026-109619), fixed on 21 Oct 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Attackers can run code on the web server without logging in.
May I check other people’s websites?
Only check websites you own or are responsible for. The check only fetches public pages, respects robots.txt and is limited against mass requests.
What does PHP have to do with email security?
A hijacked web server is often abused for phishing, with your domain as the sender. DMARC, SPF and DKIM stop such emails from reaching your customers. That is exactly what DomainRadar monitors.
Now 14 days free
Protect your domain
Write to us – we show you DomainRadar with example data and work out with you which plan fits.
Or directly by email: info@domainradar.ch
- No commitment
- No credit card
- Ends on its own after 14 days