Is your website vulnerable to PHP2Shell?

Updated October 2026 · v1.0.0

PHP Vulnerability Checker is a free Chrome extension by Pick Ads that checks whether a website publicly exposes a PHP version affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

If your site runs on PHP - WordPress, WooCommerce, Laravel, Magento, or most shared hosting - you get a clear verdict, the patched version to move to, and hosting-specific next steps.

Checks are passive: one ordinary homepage request, the same as any visitor. No exploit or attack traffic is ever sent.

Free includes 1 signed-in site. Fix Pack is a one-time add-on for one site. Premium is $39 / month for up to 10 sites (monthly only).

Check a site online (no install)

PHP Vulnerability Checker extension icon

1 / 1

What Is PHP Vulnerability Checker?

It is a PHP version checker for the PHP2Shell advisory. Open a site, click the toolbar icon, and see whether the publicly exposed PHP version falls in an affected range - or follow free steps when the version is hidden.

Optional Fix Pack unlocks one site’s full remediation workflow (guides, ticket templates, recheck, PDF). Premium covers up to 10 sites per month with bulk check. Sign-in is only required for those paid and freemium entitlements.

Key Features

One-click PHP version check

Check the site you are on, or type any domain you are authorized to assess.

Clear risk verdict

Potential risk, end-of-life PHP, no known indicators, unable to verify, and related statuses - with the patched branch when applicable.

Find a hidden version

Free 1-minute steps for WordPress Site Health, cPanel, Plesk, DirectAdmin, Hostinger, and more when the server hides PHP.

Hosting fix guides

Signed-in Free, Fix Pack, and Premium unlock full step-by-step guides for common panels and VPS setups.

Fix Pack for one site

One-time unlock: exact clicks/commands, host/developer messages, rollback notes, recheck, and PDF proof for one domain.

Premium for agencies

Up to 10 sites each month, bulk check from a pasted list, and per-site PDF reports. Cancel anytime.

Free vs Premium

Free

Unlimited passive checks (subject to fair-use API limits).
Risk verdict and patched version targets.
Free find-your-version steps when PHP is hidden.
Sign in for 1 free site with recheck, full guides, and PDF.
Optional toolbar badge for affected sites.

Premium (monthly)

For freelancers and agencies with several sites. Fix Pack remains available as a one-time add-on for a single site.

$39 / month

Everything unlocked for up to 10 sites per billing month.
Bulk check: paste domains and check them together.
My sites overview with status per domain.
PDF report per site.
Cancel anytime from Account in the extension.

Who Is PHP Vulnerability Checker For?

WordPress on shared hosting

Open the site, run a check, and use the free Site Health path if the version is hidden - then upgrade in cPanel / hPanel when needed.

Agency client audit

Paste client domains into Premium bulk check, export PDF proof, and share Fix Pack guides per host.

After a PHP upgrade

Recheck the same site to confirm the public version moved into a patched release.

End-of-life PHP

See when a branch has no official fix and which target versions the advisory recommends.

How to Check a Site for PHP2Shell

Install PHP Vulnerability Checker and pin it from Chrome’s puzzle menu.
Open your website (or a public site you are authorized to assess).
Click the toolbar icon. We make one normal homepage request and compare any public PHP version to the advisory.
If the version is hidden, follow the free hosting steps or enter the version from WordPress Site Health / your panel.
Sign in for one free site slot, or unlock Fix Pack / Premium for more sites and PDF reports.

A detected version is an initial security signal, not proof that a site is exploitable or fully patched. Vendors may backport fixes.

Frequently Asked Questions

Does this tool hack or test my website?

No. It is a passive checker. It reads what a normal homepage request already shows. It never sends exploit code.

Is my WordPress site affected by PHP2Shell?

Open the site and click the extension. If the version is hidden, use WordPress → Tools → Site Health → Info → Server and enter that PHP version.

What is Fix Pack vs Premium?

Fix Pack is a one-time unlock for one site (full guides, recheck, PDF). Premium is $39 / month for up to 10 sites plus bulk check. There is no yearly Premium SKU.

Will upgrading PHP break my site?

Same-branch updates rarely break anything. Jumping from EOL branches can affect old plugins - guides include backup, compatibility, and rollback notes.

Is this affiliated with The PHP Group?

No. PHP Version Checker by Pick Ads is independent and not affiliated with The PHP Group. Advisory sources include GitHub Security Advisories and php.net supported versions.

Privacy

Checks are passive and initiated by you. Optional sign-in is for Fix Pack / Premium. Analytics never include site URLs or PHP versions. See the privacy policy for full details.

PHP Vulnerability Checker privacy policy

Check Your PHP Version in One Click

See PHP2Shell risk, the patched release, and hosting next steps - without exploit traffic.

All Extensions · Contact · Terms

More Chrome extensions

Explore other Pick Ads extensions, or browse the full extensions directory.

All Extensions