Cyber Security Services Launches Free PHP2Shell Check for Website Owners

New tool shows whether a website’s host and firewall have addressed the critical PHP flaws, without giving site owners a false sense of security

COLUMBUS, OH, UNITED STATES, October 23, 2026 /EINPresswire.com/ — Cyber Security Services, a Columbus cybersecurity consulting firm, today released a free PHP2Shell check at PHPCheckup.com. Website owners enter their site’s address and get a plain-English answer on their exposure to PHP2Shell, the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) patched on October 21. The check is passive. It never sends attack traffic, and it says clearly when it cannot confirm a fix from outside.

Expert analysis: what site owners are missing
Based on the published advisories and its own testing while building the check, Cyber Security Services highlights five points:
1. A version number is not proof. Many hosts and Linux vendors patch PHP without changing the version number. A PHP build date of October 21, 2026 or later is the better sign of a fixed build.

2. Most sites hide their PHP version. Of about 45 well-known websites the firm tested, none showed it publicly. That is good practice, but it means no outside scan can confirm the fix.

3. Host announcements have gaps. GoDaddy, Hostinger and Bluehost report patching shared and managed hosting, but each says VPS and dedicated server customers must update PHP themselves.

4. Firewalls buy time, not a fix. Cloudflare turned on blocking rules for every plan and reports attackers already changing payloads to get around them. Rules only cover traffic that passes through them, and in the firm’s testing several well-known sites had development or mail servers outside their firewall service.

5. The next deadline is close. PHP 8.2 stops receiving security fixes on December 31, 2026, so sites patched on 8.2 this week still need an upgrade within ten weeks.

Background: what PHP2Shell is
PHP2Shell is two flaws in PHP itself, the language behind WordPress, Drupal, Joomla and Magento. The PHP project rates both 9.2 out of 10 and fixed them in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, 2026 (php.net advisory). PHP 8.1 and older get no official fix. Researchers from Calif, Wiz Research and OpenAI are credited with the discovery, and watchTowr reports exploitation attempts in the wild.

What the check shows
The check combines what a server reveals with what its host and firewall provider have publicly said, links each claim to its source, and never reports a hidden version as safe. For each site it shows a PHP2Shell verdict, from “Fixed version reported” to “Likely vulnerable”; the hosting provider and any firewall in front, such as Cloudflare, with each provider’s statement; DNS names that may let attackers go around the firewall; and exact security header fixes and the site’s PHP support status.

Provider statements are reviewed several times a day.
“Most website owners have no way to know whether PHP2Shell affects them. Updating WordPress does not fix it, and a scan that says ‘version hidden’ tells them very little,” said Matt Santill, founder of Cyber Security Services. “We built this check to give an honest answer: what we can see, what their host and firewall provider have said, and exactly what to confirm next. If we cannot verify something from the outside, the tool says so.”

Availability: The PHP2Shell Check is free and requires no sign-up. Organizations that want an authorized web application penetration test or help upgrading can schedule a free consultation through the same page.

About Cyber Security Services
Cyber Security Services (Cybersecurity Services, LLC) is a U.S.-based cybersecurity consulting and services firm headquartered in Westerville, Ohio, in the Columbus metropolitan area. Founded in 2014, it provides penetration testing, cybersecurity risk assessments, compliance support, virtual CISO services, managed security operations and incident response. The firm works primarily through MSP, reseller and distribution partners and also builds the AILeakShield and SOC2audit.ai platforms. Learn more at cybersecurityservices.com.

Matt Santill
Cyber Security Services
matt.santill@cybersecurityservices.com
Visit us on social media:
LinkedIn

Media gallery