Is your site affected by PHP2Shell?
Two critical PHP flaws that let an attacker run code on the server without logging in were fixed on 21 October 2026 (CVSS 9.2). Enter your address and we'll check for free.
How it works
We send a normal request to your homepage (plus the login page on WordPress sites) and compare the PHP version the server reveals, its cookies and platform signs such as WordPress or OpenCart against the fixed releases.
We don't exploit the flaw, send attack-like requests, or try to reach your admin panel or files.
If the version is hidden, the result is "unverified". Linux distributions can patch without changing the version number. This is a preliminary check, not a full security audit.
What to do if you're affected
- Find your version. In cPanel, the MultiPHP Manager or Select PHP Version screen shows your site's version.
- Update, or have it updated. On shared hosting your provider applies the update; ask them in writing. On 8.1 or older you need to move to a supported version.
- Test the site. A version change can break old themes and plugins. Check forms, checkout and the admin panel.
- Check for compromise. The flaw may have been exploited before it was published. Have the server scanned for malicious files and backdoors.
If you have server access
An external check can't be definitive when the version is hidden. OpenAI, one of the teams that found the flaw, released the open-source php2shell-checker under Apache 2.0; we use the same version thresholds. If Node.js is on the server, over SSH:
# On the server, over SSH
git clone https://github.com/openai/php2shell-checker
cd php2shell-checker
node phpcheck.js --localOn cPanel, the MultiPHP Manager screen shows the version your site serves over the web; compare it with the table above.
Note: --local checks the command-line PHP version. On multi-version servers such as cPanel, your site may run a different one. GogiTools is not affiliated with OpenAI.
If you'd rather we did it, we connect to your server and check the version, the distribution patch and signs of compromise in one go. Leave a support request.
Get support
The first assessment is free. Our team handles these for you: