PHP version checker: is your site patched for PHP2Shell?
On Oct 21, 2026, PHP fixed two critical remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell"). Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. What happened and what to do →
Check your site in three steps
- Enter domain
- Prove you own it
- Get result
- Reads only public headers. Never runs the exploit or sends attack traffic.
- Owner-verified. Only domains you prove you own.
- Results deleted after 30 days. Never published.
- Free. Built by Keith Motte (ex-AWS Enterprise Support Manager).
Prove you own
This keeps anyone from checking a site they don’t own. Pick one option. Your code is valid until .
Type
TXTName / Host
Value / Content
How to add a TXT record
- Sign in where your domain’s DNS is managed. That is usually the company you bought the domain from, your web host, or a separate DNS service.
- Find the DNS records for your domain and add a new record of type TXT.
- Paste the Name. If the form adds your domain to the end automatically, enter only
_phppatchcheck. You can also put the record on the domain itself (, often written@). - Paste the Value, leave TTL at its default, and save.
DNS changes can take a few minutes to show up. We’ll keep checking for you.
File address
File contents (only this line)
How to upload the file
- Download the file above, or create a plain-text file named
php-patch-check.txtcontaining only the code. - Upload it into a folder named
.well-knownat the top level of your website, using your host’s file manager, SFTP or FTP. Create the folder if it isn’t there. - Open the file address in your browser. You should see only the code. It must load over HTTPS with no redirect.
Your result for
Ownership verified for 30 days. We make one normal request to your homepage (two if it redirects to www) and read only the version your server announces.
Your private recheck link
Bookmark it to recheck in one tap and see your history. Anyone with the link can recheck this domain and see its results, so keep it private. We store only a scrambled copy of it.
Optional next step: check your AI keys and connected apps
A free 14-item checklist for AI keys, spending limits, connected apps and AI agents. Answers stay in your browser, and you get a dated record with your top 3 next steps.
Want a heads-up next time?
One email when php.net publishes a PHP release tagged as a security fix, with an unsubscribe link in every message. Optional.
Other ways to check your PHP version
- Your hosting control panel (cPanel, Plesk or your host's dashboard).
php -von the server.- The build date in a private phpinfo() page. Hosts that backport the fix may keep the old number; GoDaddy says a fixed site can show 8.5.11.[GoDaddy]
More in how to check your PHP version and what to ask your host. Using AI tools or connected apps? Try the access checklist. Only want alerts? .