Heard about the PHP2Shell thing? Let's see if your website's okay.
Pop your web address in. Thirty seconds, no jargon. If we can't tell from the outside we'll say so and show you how to find out for certain.
Check your site
Two ways to know for certain: check it yourself (two minutes, steps below) or let us check it for you, £49.
Want to know for certain?
Tools → Site Health → Info → Server and look for "PHP version". On most hosting, your control panel (the place you log in to manage your hosting) has a "PHP version" or "Select PHP version" page.Got a web person? There's a file they can run.
- Copy the code below, save it as
php-check.php. - Upload it to your site (through your hosting control panel's File Manager, or however your web person usually adds files) and visit
yoursite.com/php-check.php. - It prints your version, whether it's safe, and deletes itself straight after.
<?php
// php-check.php — upload, visit in a browser. It deletes itself after running.
$v = PHP_VERSION;
$floor = ['8.2'=>'8.2.35','8.3'=>'8.3.36','8.4'=>'8.4.27','8.5'=>'8.5.12'];
list($maj,$min) = array_map('intval', explode('.', $v));
$safe = ($maj>8) || ($maj==8 && $min>5) || (isset($floor["$maj.$min"]) && version_compare($v,$floor["$maj.$min"],'>='));
header('Content-Type: text/plain');
echo "PHP version: $v\n";
if (PHP_EXTRA_VERSION !== '' && !$safe) {
echo "RESULT: DISTRO BUILD — your host may have backported the fix.\n";
echo "Check: apt changelog php8.x (Debian/Ubuntu) or rpm -q --changelog php (RHEL/CloudLinux)\n";
echo "Look for CVE-2026-109618 / CVE-2026-109619.";
} else {
echo $safe ? "RESULT: PATCHED / SAFE" : "RESULT: NOT CONFIRMED SAFE — speak to your host";
}
@unlink(__FILE__);
How this check works (and its limits)
- Green — your site is openly showing a fixed version. A strong sign, though not a cast-iron guarantee, because we only read what your site shows the public.
- Red — it's showing an old or unsupported version that needs updating.
- Amber — your host hides the version (very common), or they've fixed it quietly without changing the number, so nobody can tell from the outside. Use the quick check above, or let us confirm it for you.
- The real fix is your host updating PHP. No plugin or download can patch it — anyone claiming otherwise is best avoided.
Want it done for you? Our check and report is £49, one-off. We confirm your site's real status, chase your host if anything needs doing, and send you a plain-English all-clear in writing. No fix, no fee. See our terms for the refund promise. Charities and community groups: free, just email us.
Never have to read the news for this again
PHP2Shell won't be the last one. The watch-and-guide care plan keeps an eye on your site and tells you, in plain English, exactly what to do when the next thing lands.
- We watch your site and the security news for the software it runs on.
- A plain-English note the moment something matters, with what it means for you. No noise in between.
- We tell you what to do, or do the chasing: we contact your host, follow up until it's done, and confirm in writing.
- A quick written check-up once a quarter, so you always know where you stand.
What it isn't: we don't log in to your site or change anything on it, and only your host can update PHP. We watch, explain and chase. Cancel any time, monthly, no tie-in.
We only use your email to tell you about your site and the plan. Privacy · Terms