Is your PHP website exposed to php2shell?

Free, open-source scanner for CVE-2026-109618 and CVE-2026-109619.

This app scans websites for

CVE-2026-109618: An out-of-memory handling vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code on affected systems.
CVE-2026-109619: A use-after-free vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code on affected systems.

How: PHPChecker reads the PHP version a site discloses and compares it with the affected range (PHP 5.4.0 – 8.5.11; fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12). Sites that hide their version are reported as “unknown”, not safe.