php2shell.me FAQ
How the owner-verified PHP2Shell check works.
Why do I have to prove I own the site?
Probing someone else's server without permission is not ours to do. A proof of control keeps php2shell.me from becoming a scanner for other people's sites, so every check is authorized by the owner of the domain.
What does the check send to my server?
Before the proof, at most one GET of the verification location you chose (/.well-known/php2shell-verify.txt or your homepage for the meta tag), or a DNS lookup. After the proof, one GET of your homepage to read its headers. No payloads, no exploit attempts, no crawling. We make at most 10 requests to any one domain in 10 minutes, whoever asks.
What do the results mean?
Likely affected: the banner shows a PHP version older than the fix for its branch. Not detected: the version is fixed, or the site shows no PHP banner. Inconclusive: a banner is present but its version is unreadable, or the site did not answer.
Can I trust a not-detected result?
No result here is proof. Many sites hide the PHP banner, and Linux distributions backport fixes without changing the version string. Check the installed package with your package manager or host.
Which versions fix PHP2Shell?
PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 fix both CVE-2026-109618 and CVE-2026-109619. Branches older than 8.2 are end of life; upgrade to a supported branch.
Do you store my domain or the result?
No. There is no account and no database. The verification token lives in your browser for ten minutes, and the logs record only event counts, never the domain.
Why is email not a verification method?
A domain-matching email address shows that you have a mailbox, not that you control the web server. DNS, file, and meta-tag proofs are stronger, so they ship first.
How do I report abuse?
Email security@sazabi.com with the time and the domain involved.