🔴 PHP2Shell alert (Oct 21, 2026): Unauthenticated RCE in the PHP engine. Affects 70% of all websites and every version since PHP 5.4.
Free test · 30 seconds

Does your site have PHP2Shell?

Enter your domain. In 30 seconds we tell you if it runs PHP, which version it exposes, and whether it is exposed to the two critical vulnerabilities from October 21.

We only scan sites you own or are authorized to scan. Passive scan: we do not send exploits.
PHP2ShellFix.org · PHPVigia.com

✓ Does it use PHP?✓ Vulnerable version?✓ Leaking information?

Three tiers

The basic test is always free. You only pay if you want to see inside your server.

Basic test
Free
  • PHP detection
  • Exposed version and applicable CVEs
  • Visible information leaks
  • Result in 30 seconds
MOST POPULAR
Deep scan
$4.99 USD
  • Verification against the real server
  • PHP extensions and modules inventory
  • CMS, plugins and theme review
  • Intrusion signals and webshells
  • PDF report with remediation steps
Full analysis
$9.99 USD
  • Everything in the deep scan
  • Server hardening and WAF
  • PHP version migration plan
  • Re-test after applying the patch
  • 60-min call with the report

Report email

We ask for it at checkout, in a dialog that will not let you continue without a valid email. That is where we send the PDF.

Support: [email protected]

What PHP2Shell is, in 4 lines

RCE without login

An attacker runs code on your server with no username or password. It does not depend on your website, but on the PHP engine.

70% of the internet

WordPress, Drupal, Joomla, MediaWiki and any PHP app. Every version since 5.4 is affected.

Memory leak

It also lets attackers read process memory: passwords, tokens and other users' keys.

A patch exists

Released Oct 21, 2026: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating is the only cure.

Download the official patches

Versions released by php.net on Oct 21, 2026. Always verify the SHA-256 before installing.

Loading patches…