BoostPHP2Shell exposure check

Find domains still exposed to PHP2Shell

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical, unauthenticated remote code execution flaws in the PHP engine itself. Any site on an affected PHP version can be at risk, whatever application it runs. Paste a list of domains or upload a CSV, and we'll flag those reporting an unpatched PHP.

Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12, 8.6.0RC4. PHP 8.1 and older get no upstream fix.

Up to 500 domains per scan. We send one ordinary GET / per domain (following up to 3 redirects) and read the response headers. Nothing is sent that could trigger the vulnerability, and nothing you submit is stored.

Reading the results

Vulnerable
The site reports a PHP version older than the fixed release for its branch, or an end-of-life branch (8.1 and older).
Likely vulnerable (distro build)
The version string predates the fix but comes from a distribution package (Debian, Ubuntu…), which may carry a backported fix. How to check.
Memory-disclosure indicator
The site issued a malformed or oversized PHPSESSID cookie, which matches the PHP2Shell memory-leak bug. Patch and investigate.
PHP, version hidden
PHP is in use but the version isn't disclosed. A passive check can't tell. Ask the owner to confirm their version.
Patched
The reported version includes the fix.
No PHP detected
Nothing on the front page suggests PHP. That does not prove PHP isn't used elsewhere on the domain.