Is my website exposed to PHP2Shell?

Q: Why does the checker say "Unknown — version hidden" instead of "Safe"?

Most managed WordPress hosts (such as WP Engine and Kinsta) and Cloudflare-fronted servers strip the X-Powered-By header so attackers cannot read the PHP version from the outside. Hiding the version is good practice, but an external check cannot tell whether the host actually installed the Oct 21, 2026 patch underneath. Even when a patched version number is visible, an HTTP header only reflects the web node that answered the request and does not audit WordPress plugins or custom code — so this tool never labels a site "Safe".

On October 21, 2026, the NSA warned website operators to patch two critical PHP security holes (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) or take vulnerable servers offline. Inspect what your server reports right now.

Check Your Website Against the October 21, 2026 PHP2Shell Advisory

On October 21, 2026, the U.S. National Security Agency warned website operators to immediately patch two critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2) or take vulnerable servers offline (Hoodline, TechCrunch). A third, lower-risk flaw (CVE-2026-115560) is scheduled for PHP’s next regular release.

This checker inspects your website’s public HTTP response headers (X-Powered-By, Server), session cookies (PHPSESSID), HTML generator meta tags, /wp-json/, and /xmlrpc.php. It reports one of four honest verdicts: Exposed (EOL version detected), Likely needs patch, Patched version detected, or Unknown — version hidden. Because many managed hosts hide the PHP version banner or backport fixes without changing the version string, this tool never claims a site is “Safe”.

Patched vs. Affected PHP Versions (Verified October 25, 2026)

PHP 8.5: Patched in 8.5.12 (8.5.0 – 8.5.11 affected) — PHP 8 ChangeLog
PHP 8.4: Patched in 8.4.27 (8.4.0 – 8.4.26 affected) — PHP 8 ChangeLog
PHP 8.3: Patched in 8.3.36 (8.3.0 – 8.3.35 affected) — PHP 8 ChangeLog
PHP 8.2: Patched in 8.2.35 (8.2.0 – 8.2.34 affected) — PHP 8 ChangeLog
PHP 8.1 and older (5.4 – 8.1): End-of-life (EOL); no official upstream patch exists.

What to Do This Week

Check your exact PHP version: In WordPress, open Tools → Site Health → Info → Server and verify the PHP version is on 8.5.12+, 8.4.27+, 8.3.36+, or 8.2.35+.
Confirm with your host: If your server runs Ubuntu, Debian, or RHEL packages, ask your host to confirm in writing that CVE-2026-109618 and CVE-2026-109619 have been patched.
Immediate stopgap if you cannot upgrade today: Set session.upload_progress.enabled = Off in php.ini to close the CVE-2026-109619 upload-progress vector until your maintenance window.

The Long-Term Case: Fewer Moving Parts, a Site You Own, Machine-Readable

On October 2, 2026 — nineteen days before the NSA advisory — Jason Falls and I published The Silent Crisis on the Web (and the follow-up Three Weeks After “The Silent Crisis,” the NSA Told PHP Sites to Patch or Go Offline). Every plugin and legacy runtime layer is another update queue and another door an attacker can test. Modern agentic builds give you fewer moving parts, a codebase you own outright, and clean structured data that ChatGPT, Perplexity, and Google AI Overviews can cite.

Step 1 ($149): AI Visibility Snapshot ($149) — manual verification of whether ChatGPT, Perplexity, and Google AI cite your business, delivered in 48 hours.
Step 2 ($750): AI Search Visibility Audit ($750) — 50-query prompt diagnostic and 15-page technical architecture & schema audit.
Step 3 (Rebuild): Talk about a rebuild — Theme-Level Hybrid ($5,000–$15,000), Decoupled Hybrid ($12,000–$35,000), or Full-Stack Application Build ($25,000–$75,000+).

Frequently Asked Questions

Why does the checker say “Unknown — version hidden” instead of “Safe”?

Managed WordPress hosts (such as WP Engine and Kinsta) and Cloudflare-fronted servers strip the X-Powered-By header so outsiders cannot read the PHP version. Hiding the version is good practice, but an external check cannot tell whether the host installed the Oct 21, 2026 patch underneath. Even when a patched version is visible, an HTTP header does not audit WordPress plugins or custom code, so this tool never labels a site “Safe”.

Which PHP versions are patched against PHP2Shell (CVE-2026-109618 & CVE-2026-109619)?

The PHP Group released emergency patches on October 21, 2026: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. PHP 8.1 and all older branches (5.4 through 8.1) are end-of-life and received no official upstream fix. A separate lower-risk vulnerability (CVE-2026-115560) is due in PHP’s next regular release.

My server runs Ubuntu, Debian, or RHEL and shows an older PHP number. Is it definitely unpatched?

Not necessarily. Linux distributions often backport security fixes into older package version strings without changing the banner. Ask your host or sysadmin to check the package changelog for CVE-2026-109618 and CVE-2026-109619.

What can I do right now if my host cannot upgrade PHP today?

As an immediate stopgap for the CVE-2026-109619 upload-progress vector, set session.upload_progress.enabled = Off in php.ini and restart PHP-FPM or Apache while you schedule the runtime upgrade.

Primary Sources

About Chris Slater & Website Architecture Services

Chris Slater builds fast, machine-readable websites and AI search systems from Nokomis, Florida through All Clear Digital. Start with a manual $149 AI Visibility Snapshot (delivered in 48 hours), a 50-query $750 AI Search Visibility Audit, or a full Website Rebuild (Theme-Level Hybrid, Decoupled React Hybrid, or Full-Stack Application Build with zero PHP).

Running WordPress or PHP? Test your domain with the free PHP2Shell Exposure Checker or read Move Off PHP: From the October 2 Warning to the October 21 NSA Advisory.