Am I vulnerable?

PHP2Shell version checker

Paste a version, php -v output, or a whole fleet — one version per line. The check runs in your browser; nothing is sent anywhere.

Last reviewed 2026-10-22

Paste a version, the output of php -v, or one version per line for a whole fleet. Runs entirely in your browser.

Try:

The CLI and the web server can run different PHP builds. Check the version your web server actually uses: php-fpm -v (or php-fpm8.3 -v), or phpinfo() served by that site.

BranchVulnerableFixed in
8.5< 8.5.128.5.12
8.4< 8.4.278.4.27
8.3< 8.3.368.3.36
8.2< 8.2.358.2.35
8.1 · 8.0 · 7.4allSource backport only
5.4 – 7.3allNo fix

Collect versions to paste

The PHP that answers web requests is what matters. The CLI on the same box can be a different build.

shell
# One host: the binary that serves web traffic
php-fpm -v 2>/dev/null || php -v

# Many hosts over SSH — paste the output into the checker
for h in web1 web2 web3; do
  printf '%s ' "$h"; ssh "$h" "php -r 'echo PHP_VERSION, PHP_EOL;'"
done

# Exact Debian/Ubuntu package version (shows distro backports)
dpkg-query -W -f='${Package} ${Version}\n' 'php*-common'

# RHEL family
rpm -q php-common

What each result means

ResultMeaningWhat to do
VulnerableUpstream version below the first fixed release of its branch.Upgrade and restart. If it is an OS package, check the changelog first — it may already carry the backport.
Check vendorVersion string carries a distro suffix (ubuntu, deb, el, amzn, suse, fc).Distros backport fixes without bumping the upstream number. Look for the CVE in the package changelog.
Vulnerable · EOLBranch 8.1 or older — no new PHP release.Migrate to 8.4/8.5. Stopgap: vendor backport, or PHP’s source backport for 7.4/8.0/8.1.
PatchedAt or above the first fixed release.Make sure every worker was restarted after the update.
Newer branchA branch newer than any covered by the advisory.Should include the fix; confirm in release notes.
UnsupportedOlder than 5.4 — outside the reported range.Not listed as affected, but long unsupported with other critical bugs. Migrate.

Why distro builds need a second look

Ubuntu’s 8.3.6-0ubuntu0.24.04.x or Debian’s 8.2.x-1~deb12uN keep the upstream number they shipped with and add security fixes on top. So a box can report “8.3.6” and still be patched. The reverse is also true: a high-looking number from an old image can be unpatched.

Packages from Ondřej Surý’s repository (deb.sury.org) follow upstream versions, so the checker treats them like official releases.

Next