---
title: New free tool: PHP Version Checker with php2shell detection
description: php2shell (CVE-2026-109618 and CVE-2026-109619) lets anyone run code on an unpatched PHP server, and the first question is which PHP version your sites really…
canonical: https://watchfor.io/changelog/2026-10-22-php-version-checker
---

[All updates](/changelog#2026-10-22-php-version-checker) ✨ New Oct 22, 2026 · v 11.9.4

# New free tool: PHP Version Checker with php2shell detection

php2shell (CVE-2026-109618 and CVE-2026-109619) lets anyone run code on an unpatched PHP server, and the first question is which PHP version your sites really run. The new free PHP Version Checker reads the version your server announces, then grades it A+ to F against php2shell, other known CVEs and the branch's end of life, with the exact release to install. It sends plain GET requests only, never an exploit.

## What it checks

- php2shell: affected, not affected, or verify, with the first fixed release of every branch: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older got no fix.

- Support: whether the branch has active support, security fixes only or has reached end of life, with the dates and the days left.

- Patch level: how many releases you are behind the branch's latest.

- Other known CVEs: the ones that affect that exact version, worst first, flagged when CISA lists them as exploited.

## Honest about what it can't see

- A hidden version gets no grade. Hiding it is good practice, and the result shows the fixed releases so you can compare with php -v .

- Debian, Ubuntu and Red Hat builds often carry fixes under an older version number. Those are never failed on the number alone: they are capped at C and linked to the vendor's tracker to verify.

It also works from a terminal: curl https://watchfor.io/php/example.com . The [step-by-step guide](/blog/php2shell-check-if-your-site-is-vulnerable) covers checking on the server and patching.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-10-22-php-version-checker · Site guide: https://watchfor.io/llms.txt