Prove control
Publish a one-time value as a DNS TXT record, a file under /.well-known/, or a meta tag. Only the owner of a site can do that.
PHP2ShellCVE-2026-109618CVE-2026-109619
Is your PHP site exposed to PHP2Shell?
Prove you control a domain, and we read its PHP version banner once and compare it to the fixed releases. Nothing is stored, and nothing is attempted against your server.
Check
Check a domain you control
How it works
Owner-verified, one request, no exploit.
One banner read
After the proof checks out, we send one GET to your homepage and read the Server and X-Powered-By headers. We do not follow redirects or touch private addresses.
Compare to the fixes
The PHP version in the banner is compared to the first release on its branch that fixes both CVEs, with links to the cve.now advisories.
FAQ
Questions
What the check does, and what it cannot tell you.
Why do I have to prove I own the site?
Probing someone else's server without permission is not ours to do. A proof of control keeps php2shell.me from becoming a scanner for other people's sites, so every check is authorized by the owner of the domain.
What does the check send to my server?
Before the proof, at most one GET of the verification location you chose (/.well-known/php2shell-verify.txt or your homepage for the meta tag), or a DNS lookup. After the proof, one GET of your homepage to read its headers. No payloads, no exploit attempts, no crawling. We make at most 10 requests to any one domain in 10 minutes, whoever asks.
What do the results mean?
Likely affected: the banner shows a PHP version older than the fix for its branch. Not detected: the version is fixed, or the site shows no PHP banner. Inconclusive: a banner is present but its version is unreadable, or the site did not answer.
Can I trust a not-detected result?
No result here is proof. Many sites hide the PHP banner, and Linux distributions backport fixes without changing the version string. Check the installed package with your package manager or host.