Cyber Security Services launches free PHP2Shell check for website owners

Cyber Security Services has launched a free PHP2Shell check at PHPCheckup.com to help website owners see whether their hosts and firewalls have addressed two critical PHP vulnerabilities patched Oct. 21. The tool gives a plain-English verdict without sending attack traffic, as security teams warn that hidden versions and partial firewall coverage can leave sites exposed.

Why it matters: - PHP2Shell affects the PHP software stack that powers WordPress, Drupal, Joomla and Magento. - The two flaws carry a 9.2 out of 10 severity rating from the PHP project. - Website owners can remain exposed even after a patch release if their host, firewall or server setup has not been updated. - PHP 8.1 and older do not get an official fix. - PHP 8.2 reaches end of security fixes on Dec. 31, 2026, which gives patched sites a short window before another upgrade is needed.

What happened: - Cyber Security Services released a free PHP2Shell check at PHPCheckup.com on Oct. 23, 2026. - The Columbus cybersecurity consulting firm built the tool for website owners who want a plain-English read on whether their site appears exposed to the two PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. - The check is passive and does not send attack traffic. - The tool says clearly when it cannot confirm a fix from outside.

The details: - The PHP project patched the flaws in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Oct. 21, 2026. - Researchers from Calif, Wiz Research and OpenAI are credited with the discovery. - watchTowr reports exploitation attempts in the wild. - The check combines what a server reveals with public statements from the host and firewall provider. - The tool links each claim to its source and never treats a hidden version as safe. - The result includes a PHP2Shell verdict ranging from “Fixed version reported” to “Likely vulnerable.” - The output also shows the hosting provider, any firewall in front such as Cloudflare, DNS names that may route around the firewall, exact security header fixes and the site’s PHP support status. - Provider statements are reviewed several times a day. - Cyber Security Services says a PHP build date of Oct. 21, 2026 or later is a better sign of a fixed build than a version number alone, because many hosts and Linux vendors patch PHP without changing the version number. - In testing about 45 well-known websites, none showed their PHP version publicly. - That makes outside verification difficult even when hiding the version is a good practice. - GoDaddy, Hostinger and Bluehost say they patch shared and managed hosting, but VPS and dedicated server customers must update PHP themselves. - Cloudflare says it turned on blocking rules for every plan and that attackers are already changing payloads to get around them. - The firm’s testing found several well-known sites had development or mail servers outside their firewall service.

Between the lines: - The new check is as much about uncertainty as it is about exposure. - A site can look protected from the outside while still relying on a host-side fix that is not visible publicly. - Firewalls can reduce risk, but they do not replace patching the underlying PHP install. - The short runway to PHP 8.2 end-of-support suggests some site owners now face a second upgrade after the emergency patching cycle. - Matt Santill, founder of Cyber Security Services, said most website owners have no way to know whether PHP2Shell affects them and that the tool is meant to show what can be seen, what hosts and firewall providers have said, and what still needs confirmation.

What's next: - Cyber Security Services says organizations can use the same page to schedule a free consultation for an authorized web application penetration test or help upgrading. - The company says it will continue reviewing provider statements several times a day. - Website owners using PHP 8.2 still need to plan an upgrade before the end-of-support deadline at the end of December.

The bottom line: - The free check is meant to close a visibility gap that standard version checks and firewall claims can miss, especially for sites that cannot prove from the outside whether PHP2Shell is fully fixed.