Skip to content
Cyber Army LogoCyber Army®
Free tool

php2shell Scanner

Check whether a site looks exposed to php2shell (CVE-2026-109618 and CVE-2026-109619), the unauthenticated PHP remote-code-execution flaw that affects an estimated 70 percent of internet-facing PHP. We read the versions your server already exposes. The scan is passive: no exploit payloads, no stored results.

What this does, and what it cannot do

  • It reads the Server and X-Powered-By headers and the WordPress generator tag your site exposes.
  • Many servers hide the exact PHP version (good practice). When that is the case, the scanner cannot confirm exposure and will tell you to check on the server with php -v.
  • A clean result is not a guarantee. It means no vulnerable version was detected from the outside, not that the site is secure.
  • Read the full write-up, including exactly how to patch and detect php2shell, in our research article.