My Digital Hero Free PHP Check

Critical flaw announced 21 October 2026

Is your website at risk from this week's PHP flaw?

A free 10-second check. Type your website address and we'll look for the warning signs of PHP2Shell, then tell you exactly what to do next.

    We load your homepage once, like a browser does. We never try to break in, and we don't keep the addresses you check.

    What happened

    • 1Two critical flaws in PHPPHP is the language behind a huge share of the web, including WordPress, Joomla, Drupal and Magento sites. On 21 October 2026 its team released emergency fixes for two flaws, nicknamed PHP2Shell.
    • 2No login neededThe flaws can let an attacker run their own code on a web server. They sit in PHP itself, so a website is exposed even if its own code is fine.
    • 3Attacks have startedSecurity firms have seen attempts to use the flaws. The PHP team says updating PHP is the only full fix. Updating WordPress or plugins alone won't do it.

    Sources: PHP security release, 21 Oct 2026 · The Hacker News · The PHP Foundation

    What the lights mean

    • Red: act today. Your website openly shows a PHP version that is missing the fix, or is too old to get one.
    • Amber: can't confirm. Your website uses PHP but doesn't show enough for us to tell. Your host can confirm in a minute.
    • Green: looks fine. Your website shows a fixed version, or shows no sign of PHP at all.
    • Grey: couldn't see. Your website didn't let our check in, or didn't answer.

    How the check works

    Alfred, the My Digital Hero robot, inspecting with a magnifying glass and clipboard

    We visit your homepage once, exactly as a browser would, and read what your server reveals about itself: the PHP version if it shows one, and the tell-tale signs of PHP systems like WordPress. We never send attack traffic. That also means no outside check can prove a website is safe or unsafe, so treat the result as a guide and confirm with whoever hosts your website.

    Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get fixes from the PHP project. Some Linux vendors add fixes to their own packages without changing the main version number, which is why a version alone isn't the whole story.