Tools
PHP2Shell Check
Enter a domain to check whether it is vulnerable to PHP2Shell, a critical vulnerability affecting millions of hosts.
Check specific subdomains for more targeted results.
PHP is the most widely used web language ever, built into the most widely used CMS, powering 70% of websites. If you use the internet, PHP is in your supply chain. Any site that hasn’t applied a security patch in October 2026 is likely still at risk of PHP2Shell. The time to find out is now.
PHP2Shell covers vulnerabilities in out-of-memory conditions and stale global state, both of which can lead to remote code execution.
of vendors using PHP were confirmed vulnerable
vendors alerted by UpGuard users in first 48 hours
faster remediation amongst vendors of UpGuard users
UpGuard PHP2Shell detection data, October 2026
“What I like most about UpGuard Vendor Risk is its centralized visibility into the third party security posture. It helps us monitor vendor risks, identify security weaknesses, monitor changes in vendor security ratings, and prioritize potential risks.”
Animesh M.,
Cyber Security Analyst
A domain or a specific subdomain, like app.example.com. No login, no agent, nothing to install.
We look for the PHP2Shell CVEs on that one domain. Other subdomains are not covered.
Vulnerable, not vulnerable, or we could not scan it, with the findings behind it.
A vendor evidence-collection questionnaire and a remediation guide, sent to your inbox.
Check specific subdomains for more targeted results.
One domain is a start. Your attack surface is bigger.
The UpGuard platform continuously finds risks like PHP2Shell across
the digital footprint of your organization and your vendors.