PHP version
If your server publishes its version (X-Powered-By or Server), we match it against PHP2Shell and the support calendar.
Your result
What your site shows the internet.
This is exactly what a bot hunting for vulnerable servers sees. What isn't visible from outside (PHP on other systems, Composer, server config) is covered by the full assessment.
0
Exposure score
–
Extended report
Most urgent
What's working
Visible software
Exposed surface
Action plan
The check only reads the public response of your home page, just like a browser. It doesn't test exploits, scan ports or replace an assessment. Use it only on domains or IPs you own or manage.
—days left
Deadline
PHP 8.2 stops getting security patches on December 31, 2026.
After that date, any new PHP 8.2 flaw stays open for good. PHP 8.1 has been there since December 2025. A careful migration takes weeks: review Composer, extensions and deprecations, then test in a separate environment.
What we check
Four signals in a single visit.
Platform
WordPress, Laravel, Livewire and the web server, with this month's flaws that apply to them.
Encryption
HTTPS, TLS version, certificate expiry and whether HTTP redirects to HTTPS.
Headers
HSTS, CSP, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
Versions
Which PHP version has the patch?
PHP branches, the release that fixes PHP2Shell (October 21, 2026) and how long they get security patches.
| Branch | Fixed in | Patched until | Status |
|---|---|---|---|
| PHP 8.5 | 8.5.12 | Dec 31, 2029 | Supported |
| PHP 8.4 | 8.4.27 | Dec 31, 2028 | Supported |
| PHP 8.3 | 8.3.36 | Dec 31, 2027 | Supported |
| PHP 8.2 | 8.2.35 | Dec 31, 2026 | Ending soon |
| PHP 8.1 | No official release | Dec 31, 2025 | Unsupported |
| PHP 8.0 | No official release | Nov 26, 2023 | Unsupported |
| PHP 7.4 | No official release | Nov 28, 2022 | Unsupported |
$ php -v $ php -i | grep -i expose_php $ composer show laravel/framework livewire/livewire $ nginx -v # SSH in and run these commands. If the version is lower than the table, update.
Source: php.net, October 21 and 23, 2026 advisories and the supported versions calendar.
How we help
From the check to a closed server.
Express patch
PHP2Shell fixed within 48 hours, with before-and-after evidence.
Fixed price
Move to PHP 8.4
Compatibility review and staged migration, before December 31.
Based on the system
Monthly monitoring
Alerts for the flaws that affect your stack, with the patch ready.
Monthly
Questions
Before you check your site.
What is PHP2Shell?
It's the name of two PHP flaws published in October 2026 (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that allow code execution on the server. PHP fixed them on October 21 in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Attacks have been reported.
Is the check safe and legal?
Yes. We request your home page once, like any browser, and read the public headers and HTML. We don't test exploits or scan ports. Use it on domains you own or manage.
My PHP version isn't visible. Am I safe?
Hiding it is good practice, but it fixes nothing. Log into the server and run php -v: if your version is lower than the table, update.
I run PHP 7.4, 8.0 or 8.1. What now?
Those branches no longer get official patches. Some distributions publish backports; otherwise the safe path is moving to PHP 8.4 and, meanwhile, restricting who can reach the server.
Do you store my domain or the result?
We don't store the result. If you ask us for help, the domain and summary travel with your request so you don't have to explain it again.
Review and drafting of legal documents is done with the support of legal specialists. WITS identifies needs and risks but does not provide legal services.
Contact
Want it patched this week?
Write to us even if you haven't run the check. If you have, your result travels with the request.
Express patch
48 hours, fixed price
PHP2Shell express patch. It includes:
- Inventory of servers and PHP versions
- Update to the fixed release or your distribution's backport
- PHP-FPM restart and proof the site is still up
- Before-and-after evidence, control by control