Menu
Free tool · CVE-2026-109618 · CVE-2026-109619
Check forPHP2Shell.
A free, no-login check for the critical PHP remote code execution flaws disclosed on 21 October 2026. Find out in seconds whether your site is exposed. Version inspection is passive; the optional active probe sends a control request plus up to three multipart probes.
CVSS v4 · critical
CVEs covered
Typical result time
Exploit payloads sent
How the check works
Safe by design.
Version inspection is passive. The optional active probe runs a control request plus 1/8/20 MiB multipart probes from a disposable sandbox.
- 01
Enter your site
Paste a public URL you are authorized to test. No account and nothing to install.
$ bugbunny php2shell example.comtarget: https://example.com/ - 02
We run a safe check
BugBunny reads version signals and, if you select it, runs a control request plus up to three nested multipart probes. No exploit code.
checking example.comphp runtime detected: 8.3.35 - 03
You get a clear verdict
See whether your PHP version is affected and exactly which release fixes it.
status: vulnerablefix: upgrade to PHP 8.3.36+
Result confidence
What the scanner can determine.
PHP2Shell lives inside the PHP interpreter, so your PHP version decides your exposure. Servers that hide their version, or run vendor builds with backported fixes, need a closer look.
Vulnerable version
The detected PHP version is in an affected range.
Appears patched
The detected PHP version is at or above its fixed release.
Unknown
We couldn't determine the exact PHP version. This is not a clean bill of health.
PHP 8.1 and earlier are end-of-life upstream. Verify any vendor backport against both CVEs.
Verdicts are based on the fixed releases in the official PHP security advisory. The check is version inspection is passive; the optional active probe sends a control request plus up to three multipart probes.
BEYOND ONE CVE