Tools

PHP2Shell Check

PHP2Shell Check

Is your supply chain\
vulnerable to *PHP2Shell?*
==========================

Enter a domain to check whether it is vulnerable to PHP2Shell, a critical vulnerability affecting millions of hosts.

Enter your domain Enter your domain

Check domain

Check specific subdomains for more targeted results.

The reality

**PHP2Shell is everywhere.**\
How does it affect you?
-----------------------

PHP is the most widely used web language ever, built into the most widely used CMS, powering 70% of websites. If you use the internet, PHP is in your supply chain. Any site that hasn’t applied a security patch in October 2026 is likely still at risk of PHP2Shell. The time to find out is now.

PHP2Shell covers vulnerabilities in out-of-memory conditions and stale global state, both of which can lead to remote code execution.

65.6%

of vendors using PHP were confirmed vulnerable

491

vendors alerted by UpGuard users in first 48 hours

2x

faster remediation amongst vendors of UpGuard users

UpGuard PHP2Shell detection data, October 2026

Before you check

## Here's what happens when you check a domain

* ### Enter a domain

  A domain or a specific subdomain, like app.example.com. No login, no agent, nothing to install.

* ### We check that server

  We look for the PHP2Shell CVEs on that one domain. Other subdomains are not covered.

* ### You get the verdict

  Vulnerable, not vulnerable, or we could not scan it, with the findings behind it.

* ### Then the response pack

  A vendor evidence-collection questionnaire and a remediation guide, sent to your inbox.

PHP2Shell Check

## Check a domain for PHP2Shell

Enter your domain Enter your domain

Check domain

Check specific subdomains for more targeted results.

One domain is a start. Your attack surface is bigger.

The UpGuard platform continuously finds risks like PHP2Shell across\
the digital footprint of your organization and your vendors.

[Start a free trial](https://www.upguard.com/demo)