Is your website still running vulnerable PHP? Check yours in 30 seconds.
On Oct 21, 2026, PHP fixed two critical remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell"). Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Why this exists and the sources →
Free. Only for domains you own. We never run the exploit, never send attack traffic, and never publish your result.
1. Your domain
2. Prove you own it
Do one of these. Your token is valid for 24 hours.
Option A: DNS TXT record on (or ) with the value:
Option B: File at containing only:
3. Check
Verified for 30 days. We'll make one normal request to your homepage (two if it redirects to www) and read only the version your server announces.
Patch alerts
Get a note when there's a new critical PHP fix. (Stored only; you can ask us to remove it anytime.)