Is PHP there?
Server headers, session cookies, page addresses and whether the site runs WordPress or another PHP-based system.
Free check · Read-only · No card
Is your website still exposed to PHP2Shell?
Two critical flaws in PHP were patched on 21 October 2026. Most small-business websites run on PHP through their host. Enter your website address and we will tell you, in plain language, what we can see from outside — and the one question to ask your host if we cannot tell.
Check my website — free
Read-only external check. We never send attack traffic, never log in, and never test your site for the flaw itself. Results arrive by email within a few minutes. Free, no card, one follow-up email about the Emergency Desk and then nothing more unless you ask.
What we check
Is the version fixed?
If the version is disclosed, we compare it with the fixed releases: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. Older branches have no official fix.
Who hosts it?
So you know exactly who to ask. If a content-delivery network sits in front, we say so.
What the result means
Green — a fixed version is visible
Your host appears to have applied the fix. Ask them to confirm the web service was restarted, because a patched file on disk does not help while the old code is still running.
Amber — PHP is there but the version is hidden
This is the normal result. Most hosts hide the version, and hidden is not the same as fixed. We give you the one question to send your host, and we will read their reply for you if you forward it.
Red — a vulnerable or unsupported version is visible
Contact your host today with the question we give you. Some Linux hosts keep the old version number after fixing, so the question settles it either way.
Grey — we cannot see PHP from outside
Your site may not use PHP, or it may be behind something that hides it. If you use a booking system, customer portal or forms supplied by someone else, PHP may be behind those — ask each supplier the same question.
The question to ask your host
Have the servers running our website been updated to a PHP version fixed for CVE-2026-109618 and CVE-2026-109619 (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later), and has PHP-FPM or the web server been restarted since? Please confirm the date.
Next time, hear about it before the news does
This check looks at one website, once. The Cyber-Safe Emergency Desk maps everything you rely on, watches the alerts, chases your suppliers and hands you the evidence — every time.