Enquire

PHP2SHELL CHECKER

PHP2Shell version risk check

Start with a URL to check the public response. If the version is hidden, optionally verify control to read the PHP runtime, or enter a version manually.

Results are a version-risk screen, not proof of exploitability or compromise. Vendor backports and other hosts require separate checks.

Version information reviewed: 2026-10-23 · CVE-2026-109618 / CVE-2026-109619

PHP2SHELL / EXTERNAL CHECK

Check PHP patch indicators and form-request responses

Enter a URL for seven external observations, patch-status guidance and next steps. No verification-file upload is needed.

What will be checked?

Read the homepage and compare ordinary forms with multipart requests over POST, PUT and PATCH. Requests contain one test text field, no files, login cookies or exploit content.

AL-Touch performs the requests without sending your URL to a third-party scanner. Response bodies and cookie values are not stored, and results are not published.

For your host: copy the check script

Give this script to your hosting provider to run the same seven types of external check from their computer or management terminal. Do not upload it to your website.

  1. Confirm you own or have permission to test the URL above. Ask your host to review the URL in the script before running it.
  2. Copy the script and save it as a plain-text file named al-touch-php-check.sh
  3. In a Linux/macOS terminal with Bash and curl, or Windows WSL/Git Bash, run: bash al-touch-php-check.sh
  4. Give the terminal output to your host for review, or include it with your enquiry to us. Do not attach passwords, cookies or private keys.

At most seven small requests, with a ten-second limit per request. They contain test text only: no files, login cookies or redirects. TLS verification stays enabled; connection failures or HTTP 429 stop the script. Results remain on the computer and are not automatically sent to AL-Touch.

Enter a valid HTTPS homepage URL above to generate its script. You do not need to complete the online check first.

Interpretation: 200 does not prove vulnerability; 403/405 does not prove blocking occurred before PHP. If no version is visible, host verification is still required.

Your host should also verify the PHP runtime/workers actually serving the site, vendor backport advisories and restart records. This external script does not replace host-level verification, and results can differ between networks.

Optional: verify control and read the PHP runtime

WEBSITE VERIFICATION

Check PHP using your website URL

Verify website control, then read the PHP version running the temporary probe. Only that short-lived file is requested; no exploitation or load testing is performed.

Use the exact hostname, for example https://www.example.com/. Hosts with and without www must be verified separately.

The URL is sent to AL-Touch. Verification expires after about 15 minutes; verification and rate-limit data are retained briefly. Results are not publicly indexed. Do not enter login URLs, passwords or confidential data.

01 / CHECK

Enter a PHP version manually

For example, 8.4.26. Leave blank if unsure to see how to confirm the version.

A backport adds fixes to an older version. Confirm the exact package and vendor advisory; this selection does not verify that evidence.

Inputs are processed in this browser only; they are not automatically sent to or stored on the server.

Sources and scope

Patch baselines come from the official PHP advisories, not a live reading of your host. Refer to the original sources for later updates and vendor backports.

PHP — Security advisory ↗CVE-2026-109618 ↗CVE-2026-109619 ↗