About this checker

PHP2Shell Checker is a free, independent tool that helps site owners and administrators find out quickly whether their PHP may be affected by CVE-2026-109618 and CVE-2026-109619 — and what to do about it. There are no ads and no sign-up.

Method: what we send

• One HEAD request to the address you enter. Only if the server answers 405 or 501 do we repeat it as a GET, and we stop reading as soon as the headers arrive.
• Up to three redirects are followed. Each new address is validated again.
• We read version-related response headers (X-Powered-By, Server) and whether a PHP session cookie is set.
• We never send exploit payloads, multipart or oversized requests, and we never probe other paths.
• Addresses that resolve to private, local or reserved networks are refused.

User-Agent

php2shellchecker.net/1.0 (+https://php2shellchecker.net/en/about#bot)

Requests come from

159.69.56.189

Limits

20 checks per hour per network, 30 per hour per target site

For site operators

If you see our User-Agent in your logs, someone entered your address in this checker. The request is identical to a normal page load and does not change anything on your server. If you want your site excluded, contact us using the link below.

Limitations

A remote check can only see what the server reveals. Many servers hide the PHP version, distributions backport fixes under old version numbers, and a server may run several PHP versions. A “fixed version” result is a good sign, not a guarantee; an “affected” result should be confirmed on the server.

Who runs it

This site is built and operated by Globya Information Technologies, a web hosting and software company in Turkey. We patched our own PHP servers on the day of the release and built this tool to help others do the same. Our team can help you update and verify your servers.