--- title: PHP Version Checker: php2shell CVE-2026-109618 description: Check your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup. canonical: https://watchfor.io/php-version-checker --- [Back to all free tools](/free-tools) PHP Version Checker Hot # Is your site vulnerable to php2shell? Check CVE-2026-109618 & CVE-2026-109619 Check your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup. [How to use this tool](/blog/php2shell-check-if-your-site-is-vulnerable) Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## The PHP version grade scale Every check returns one of these grades, with the reasons and the exact version to install. A version we can't see gets no grade at all: hiding it is good practice, and we never mark a site down for it. Distribution builds that backport fixes are never failed on the version number alone. A+ Excellent The latest patch release of a branch with active support, with no known CVE affecting it. A Good Patched against everything serious, one step short of A+: a patch release or two behind on an active branch, or the latest release of a branch that now gets security fixes only. B Needs attention Behind on a security-only branch, a branch that loses security support within six months, or a medium-severity CVE that a newer patch fixes. C Weak A high-severity CVE affects this version, or a distribution build whose version falls in a critical range: verify with your vendor that the fix is in. D Poor The release branch reached end of life within the last two years: no more fixes, for any bug, from anyone upstream. F Failing Affected by php2shell, by another critical CVE or one that is known to be exploited, or the branch has been out of support for more than two years. ## Every rule, in full The grade starts at A+ and each problem can only lower the ceiling, so the grade is always explained by the worst finding in the report. Rules version php-2026.10 . Grade at most When F Affected by php2shell (CVE-2026-109618, CVE-2026-109619): PHP below 8.2.35, 8.3.0–8.3.35, 8.4.0–8.4.26 or 8.5.0–8.5.11 F Affected by a CVE in CISA's Known Exploited Vulnerabilities catalog, or any CVE scored 9.0 or higher F The release branch reached end of life more than two years ago D The release branch reached end of life within the last two years C Affected by a high-severity CVE (CVSS 7.0–8.9) C Distribution build (Debian, Ubuntu, Red Hat, SUSE) whose version would otherwise be D or F: the vendor may have backported the fix, so verify — capped at C, never failed on the version alone B Affected by a medium-severity CVE (CVSS 4.0–6.9) B On a security-only branch and behind its latest patch release B The branch loses security support within 180 days A On a security-only branch, on its latest patch release A Behind the latest patch release of a branch with active support — The version is visible in X-Powered-By or Server: reported with the config that hides it, not graded (hiding it is good practice but fixes nothing) — Version hidden, PHP not detected, or the page did not load: no grade [How WatchFor grades everything the same way](/grades#php-version) ## What is PHP Version Checker ? php2shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, announced by the PHP project on Oct 20, 2026 and fixed on Oct 21, 2026. Both are bugs in PHP itself — in how it cleans up request memory after an out-of-memory error, and in global state that can keep pointing at freed memory — and both lead to unauthenticated remote code execution (CVSS 9.2). A public proof of concept exists, and PHP's own advisory says every installation serving web requests is at risk. It is not a WordPress or framework bug: the fix is a new PHP build, not a plugin update. This free PHP version checker tells you, from the outside, what an attacker's scanner sees: the PHP version your server announces in its X-Powered-By or Server header. It grades that version A+ to F against php2shell, the other known CVEs from NVD, CISA's Known Exploited Vulnerabilities catalog and the PHP release calendar — whether your branch still gets security fixes, its end-of-life date, and how many patch releases you are behind — and names the exact version to install. It only sends normal GET requests. Nothing exploit-like ever leaves our probes. ## How it works One URL in, a graded answer out: - 1 One normal request — A probe location near you fetches the page with a plain GET, follows redirects, and keeps the response headers. If the page shows no PHP version, it makes exactly one more GET, to /index.php on the site the page landed on — PHP often announces itself on a PHP-served path when the home page is static or cached. That is the whole conversation. - 2 Read what PHP announces — With expose_php on (the default in php.ini-development and in many distribution builds), PHP adds X-Powered-By: PHP/8.3.14 to every response. Apache with mod_php can add PHP/8.2.20 to the Server header instead. A distribution suffix such as -1ubuntu2.19 , +deb12u1 or (Debian) in Server is kept, because it changes what the version proves. A PHPSESSID cookie shows PHP runs even when the version is hidden. - 3 Match it against the data — The version is compared with the affected ranges of php2shell and of every PHP CVE in NVD, flagged where CISA lists it as exploited in the wild, and placed in its release branch: active support, security fixes only, or end of life, with the dates. Release data comes from php.net and endoflife.date, refreshed every few hours. - 4 Grade it — The grade starts at A+ and every finding can only lower it: php2shell or a critical or exploited CVE is an F, an end-of-life branch a D (F after two years), a high-severity CVE a C, a security-only branch that is behind a B. The full rule table is under the tool. No version visible means no grade. That is the honest answer: hiding the version is good practice, and we can't see what you run from outside. ## When you'd use it ### Right now, because of php2shell You need to know which of your sites still run an affected PHP before someone else finds out. Run each public hostname; any F from php2shell needs the patch today. Then check the servers that hide their version on the box itself, with php -v and the web server's own PHP. ### After patching Package managers update the CLI binary while PHP-FPM keeps running the old one until it restarts, and a container keeps its old image until it is rebuilt and redeployed. Run the check again after the restart: the version the web server announces is the one that answers requests. ### Auditing an inherited or client site An agency site from 2019, a forgotten marketing microsite, a client's shared hosting plan. One run tells you whether its PHP branch is past end of life and how far behind it is, with a link you can send to whoever owns it. ### Planning upgrades The branch card shows how many days of security fixes your branch has left. Anything under six months is a B for a reason: that is roughly how long a careful upgrade of a large application takes to test. ## Reading the result ### The grade and the first thing to fix The letter is capped by the worst finding, and the line under it names that finding. Every finding is listed worst first with what it means, the highest grade it allows and the fix. ### What we saw The exact header line that revealed the version — for example X-Powered-By: PHP/8.1.2-1ubuntu2.19 — and every request we made, with its status code and where redirects landed. If you think the result is wrong, this is the evidence to compare with your server. ### php2shell Affected, not affected, or verify. Verify means a distribution build whose version is in the affected range: the vendor may have backported the fix, and its tracker (linked in the card) says which package version has it. The table lists the first fixed release of every supported branch. ### Branch support and patch level Every PHP branch gets two years of active support and two years of security fixes, then nothing. The card shows the release date, both end dates, the days left (or since the end), and the patch gap, e.g. 8.3.14 → latest 8.3.36 (22 releases behind) . ### Other known CVEs Every other CVE whose affected range includes the version, worst first, with its CVSS score and a KEV badge when CISA lists it as exploited. Some apply only to one setup — PHP-CGI on Windows, or PHP-FPM behind a particular nginx configuration — and say so. ## php2shell: affected and fixed PHP versions CVE-2026-109618 and CVE-2026-109619 have the same ranges. NVD marks every release below 8.2.35 as affected, so the branches that reached end of life got no fix. Branch Affected Fixed in Released PHP 8.5 8.5.0 – 8.5.11 8.5.12 Oct 21, 2026 PHP 8.4 8.4.0 – 8.4.26 8.4.27 Oct 21, 2026 PHP 8.3 8.3.0 – 8.3.35 8.3.36 Oct 21, 2026 PHP 8.2 8.2.0 – 8.2.34 8.2.35 Oct 21, 2026 PHP 8.1 and older Every release No fix — end of life — ## PHP versions: release dates, support and end of life Every PHP branch since 7.0, newest first, with the latest release of each. Days are counted from today; data as of Oct 22, 2026. Branch Released Active support until Security support until Days left Latest PHP 8.5 Nov 20, 2025 Dec 31, 2027 Dec 31, 2029 1,166 days left 8.5.12 PHP 8.4 Nov 21, 2024 Dec 31, 2026 Dec 31, 2028 801 days left 8.4.27 PHP 8.3 Nov 23, 2023 Dec 31, 2025 Dec 31, 2027 435 days left 8.3.36 PHP 8.2 Dec 8, 2022 Dec 31, 2024 Dec 31, 2026 70 days left 8.2.35 PHP 8.1 Nov 25, 2021 Nov 25, 2023 Dec 31, 2025 ended 295 days ago 8.1.34 PHP 8.0 Nov 26, 2020 Nov 26, 2022 Nov 26, 2023 ended 1,061 days ago 8.0.30 PHP 7.4 Nov 28, 2019 Nov 28, 2021 Nov 28, 2022 ended 1,424 days ago 7.4.33 PHP 7.3 Dec 6, 2018 Dec 6, 2020 Dec 6, 2021 ended 1,781 days ago 7.3.33 PHP 7.2 Nov 30, 2017 Nov 30, 2019 Nov 30, 2020 ended 2,152 days ago 7.2.34 PHP 7.1 Dec 1, 2016 Dec 1, 2018 Dec 1, 2019 ended 2,517 days ago 7.1.33 PHP 7.0 Dec 3, 2015 Jan 4, 2018 Jan 10, 2019 ended 2,842 days ago 7.0.33 ## Check it yourself The same headers from a terminal — or the same graded check from ours: curl -sI https://example.com | grep -iE '^(x-powered-by|server):' curl https://watchfor.io/php/example.com On the server, php -v shows the CLI's version; the web server can run a different build. php-fpm8.3 -v (the binary name varies by distribution) or a one-line