What an attacker can do
Unauthenticated remote code execution
CISA’s PHP alert (21 October 2026, revised 26 October) says these vulnerabilities “allow for unauthenticated remote code execution in PHP.” CERT-In note CIVN-2026-0510 (21 October 2026) describes a “High risk of remote code execution and complete system compromise.”
CISA PHP alert, 21 Oct 2026 (revised 26 Oct) · CERT-In CIVN-2026-0510, 21 Oct 2026A path to the file system or database
The BBC (21 October 2026), quoting the US National Security Agency, reported: “These vulnerabilities often provide a direct path to the server’s file system or database.”
BBC, quoting NSA, 21 October 2026Install malware and take down websites
The BBC (21 October 2026), quoting CERT-EU, said such an attack “could potentially allow hackers to install malware and take down websites.”
BBC, quoting CERT-EU, 21 October 2026PHP workers launching shells or tools
CISA’s PHP alert (21 October 2026, revised 26 October) told organisations to “Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.”
CISA PHP alert, 21 Oct 2026 (revised 26 Oct)Who took systems offline
21 October 2026
Finland, the Dutch NCSC, and Wikimedia
The BBC reported on 21 October 2026 that Finland “has temporarily shut down the government’s public web services,” that the Netherlands’ cyber-security agency “said it was taking its own website offline,” and that the Wikimedia Foundation said it had “taken down a number of other systems as a precautionary measure until they can be safely patched.” The same report said the Dutch RIVM “has taken down its website” and that the Tweede Kamer site “has become inaccessible.”
BBC, 21 October 202621 October 2026, revised 26 October
CISA on taking systems offline
CISA said: “Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.”
CISA PHP alert, 21 October 2026 (revised 26 October)21 October 2026
CCCS on isolating applications
In its 21 October 2026 statement, the Canadian Centre for Cyber Security said: “As a precaution, some websites may be temporarily unavailable while security patches are applied to reduce the risk of exploitation.” It also said: “Where immediate patching is not feasible, organizations should isolate affected internet-facing applications from public networks until they can be protected.”
CCCS statement, 21 October 2026 · AL26-026How it works
Enter your website
Paste the site address. You do not need to prove control, and you do not need an email to run the check.
See your result instantly
We read headers such as X-Powered-By from at most a couple of ordinary HTTPS requests to the homepage.
We fix it for you
Ask us to apply the update. The primary option is a managed fix, done for you.
We do not attempt exploits, and we do not probe other paths or ports. This does not check whether the site has already been compromised.
Run the check
Result
If you want help updating PHP
Fix it for me
₹9,999 or CAD 299
Plus applicable taxes. A managed patch, done for you, on a PHP release you approve.
Guided patch
₹4,999 or CAD 149
Plus applicable taxes. A walkthrough with you, if you would rather apply the update yourself.
Quotes and invoices are sent by email from hello@opulencedigitech.ca, from Opulence Digitech Inc., 9675 King George Blvd, Surrey, BC V3T 0T7, Canada. Payment is by invoice. This page does not collect card numbers. We will not send an INR invoice until an accountant has answered how GST applies when a Canadian company bills a buyer in India.
Request a fix
We do not collect passwords or hosting logins on this page, and we do not store credentials in email, WhatsApp, chat, or our database. After the quote, we will ask you to add us as a scoped delegate or collaborator in your hosting panel. If we use a one-time secure link, it will not carry a password in plain text. At the end of the job we will ask you to remove that access, and we will confirm the removal in the proof we send you.
Notes and terms
Backport caveat
A host or Linux distribution may have backported a fix without changing the version number.
If the version string has a package suffix (for example 8.3.6-1ubuntu), we report unknown, with the note that this is a distribution build, which may include a backported fix, rather than below the fixed release.
Banner and version-string counts, including the CloudSEK India figures and the Censys installation counts, can look unpatched when a backport is in place. If a check result is “Below the fixed release,” we also show this caution on that result: your host or Linux distribution may have backported the fix without changing the version number. Check with your host or the package changelog before paying for any update.
This is not a compromise check
This only reads the version number. It does not check whether the site was already compromised.
This check reports what your site discloses. It is not an audit, a certification, or a guarantee about the safety of the site.
We then make at most a couple of ordinary HTTPS requests to that host’s homepage and read headers such as X-Powered-By.
Privacy
If you only run the free check, we do not ask for your name or email. The result is shown in your browser only. We do not email it, we do not store it, and we do not keep a list of checked domains or results. We store only a short-lived count of requests from your network address and of checks for each domain, so we can rate-limit the form. We do not store the body of the website. Check results are not used for outreach.
If you request a fix, we store your name, email address, optional WhatsApp number, the site URL, the hosting provider you selected, the offer you chose, consent records, and timestamps. We attach the check result to that request only if you have confirmed you are the owner or are authorised by the owner. We do not collect or store passwords or hosting logins. Fix requests are kept for 24 months, or longer if you become a customer and tax law requires us to keep invoices.
Data is processed on Cloudflare's network, which may be outside your country (including the United States). You can complain to the Office of the Privacy Commissioner of Canada or, in India, the Data Protection Board. To ask a question about this data, or to ask us to delete it, email hello@opulencedigitech.ca.
Terms and what this check covers
PHP2Shell is a name used for two defects in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project published fixed releases on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
PHP 8.1 and older branches have reached end of life. The PHP project does not publish an official fix for these defects on those branches.
The US National Vulnerability Database describes both CVEs as conditions that can lead to remote code execution. CERT-In’s note says a remote attacker could send a specially crafted request. CCCS alert AL26-026 (21 October 2026, updated 27 October) says successful exploitation could allow an unauthenticated threat actor to execute arbitrary code, that internet-facing PHP is at heightened risk, and — in Update 2 — that open-source reporting indicates these two CVEs are being exploited in the wild.
This page is a free, instant check of the PHP version a site already discloses, plus an offer to fix it. You enter a website address. We then make at most a couple of ordinary HTTPS requests to that host’s homepage and read headers such as X-Powered-By. We do not attempt exploits, and we do not probe other paths or ports. Results are: at or above the fixed release, below the fixed release, end-of-life, or unknown. This only reads the version number. It does not check whether the site was already compromised.
We do not collect passwords or hosting logins on this page, and we do not store credentials in email, WhatsApp, chat, or our database. After a quote for a managed fix, we will ask you to add us as a scoped delegate or collaborator in your hosting panel. If we use a one-time secure link, it will not carry a password in plain text. At the end of the job we will ask you to remove that access, and we will confirm the removal in the proof we send you.
Quotes and invoices come from Opulence Digitech Inc., 9675 King George Blvd, Surrey, BC V3T 0T7, Canada, by email from hello@opulencedigitech.ca. Payment is by invoice. This page does not collect card numbers. Prices are plus applicable taxes. We will not send an INR invoice until an accountant has answered how GST applies when a Canadian company bills a buyer in India.
Sources: CISA KEV addition, 26 October 2026; CISA PHP alert (revised 26 October 2026); CERT-In CIVN-2026-0510; CCCS AL26-026, Update 2; CCCS statement, 21 October 2026; NVD CVE-2026-109618; NVD CVE-2026-109619; Twilio, 11 November 2026, citing Censys; Times of India, 24 October 2026, citing CloudSEK; BBC, 21 October 2026.