Is your website exposed to the October PHP flaws?
Two critical PHP flaws were patched on 21 October 2026. Sites on PHP 8.1 or older won’t get an official fix. See what your site shows the world.
We make a normal visit to your homepage, like a browser would, and check that http redirects to https. This is not a security test. We never try to break in.
Free and informational, not a security audit. See our Terms and Privacy Policy.
Six things your homepage tells the world.
PHP version
Whether your site shows a PHP version older than the 21 October fix, or runs PHP with the version hidden.
Website platform
WordPress, Joomla or similar, and whether the version looks out of date.
HTTPS certificate
That the padlock works and the certificate isn’t about to expire.
Security headers
Basic browser protections most modern sites switch on.
Server software
Whether your server announces its version to anyone who asks.
Signs of age
Clues like an old copyright year that the site hasn’t had care in a while.
A report, a chat, a plan.
- 01
Get a plain-English report
No jargon. What we found and what it means for you.
- 02
Talk to a developer
If anything looks off, request a call or a quote. The consultation is free.
- 03
Patch it, or rebuild it
Sometimes an update is enough. If the site is old, a rebuild can cost less over time.
New to php2shell? Read what the October 2026 PHP flaws mean for your business website, or see how we build websites.
Common questions.
Is this a security scan?
No. It makes a normal visit to your homepage, like a browser would, and checks that http redirects to https. It reads what your site shows the public, such as the PHP version, platform, certificate and security headers. It never sends attack payloads or looks at other pages.
Does it prove my site is safe?
No. A passive check can only see what your homepage shows, so a clean result is a good sign, not proof. A version number alone doesn’t prove a site can be hacked either, because some hosts patch PHP without changing the number.
Why does my PHP version matter?
Two critical PHP flaws, known as php2shell (CVE-2026-109618 and CVE-2026-109619), were fixed on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no official fix, so an old version is a strong sign your site needs attention.
What if my PHP version is hidden?
Hiding it is good practice, but it doesn’t tell us whether you’re patched. If we see other signs your site runs PHP, such as WordPress or a PHP session cookie, we suggest asking your host whether it was updated after 21 October 2026.
Do you store my site?
We don’t keep check results in a database. To limit abuse, we keep your IP address and the site you checked in short-lived counters that are deleted within a few days. If you ask for an emailed report, we keep your email address and the site so we can send it and honour unsubscribes.
What happens if it finds a risk?
You see what we found in plain English. You can request a call or a quote, and we’ll tell you straight whether to patch the site or rebuild it. The consultation is free.