{"id":1180,"date":"2026-10-22T22:43:07","date_gmt":"2026-10-22T20:43:07","guid":{"rendered":"https:\/\/www.meit.ch\/?page_id=1180"},"modified":"2026-10-22T22:55:22","modified_gmt":"2026-10-22T20:55:22","slug":"php-check","status":"publish","type":"page","link":"https:\/\/www.meit.ch\/en\/php-check\/","title":{"rendered":"PHP Check: Is your website affected by php2shell?"},"content":{"rendered":"<p><section class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling meit-sec meit-dark meit-subhero\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-padding-top:clamp(56px,6vw,88px);--awb-padding-right:clamp(20px,4vw,48px);--awb-padding-bottom:clamp(64px,7vw,96px);--awb-padding-left:clamp(20px,4vw,48px);--awb-margin-top:0px;--awb-margin-bottom:0px;--awb-background-color:var(--awb-color8);--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:calc( 1080px + 48px );margin-left: calc(-48px \/ 2 );margin-right: calc(-48px \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column fusion-flex-align-self-stretch\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:24px;--awb-margin-bottom-large:20px;--awb-spacing-left-large:24px;--awb-width-medium:100%;--awb-spacing-right-medium:24px;--awb-spacing-left-medium:24px;--awb-width-small:100%;--awb-spacing-right-small:24px;--awb-spacing-left-small:24px;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-1 fusion-text-no-margin meit-crumbs\" style=\"--awb-margin-top:0px;--awb-margin-bottom:14px;\"><p><a href=\"\/en\/\">Home<\/a> \/ <a href=\"\/en\/knowledge\/\">Knowledge<\/a> \/ PHP Check<\/p>\n<\/div><div class=\"fusion-text fusion-text-2 fusion-text-no-margin meit-eyebrow\" style=\"--awb-margin-top:0px;--awb-margin-bottom:18px;\"><p>Security update \u00b7 21 October 2026<\/p>\n<\/div><div class=\"fusion-title title fusion-title-1 fusion-sep-none fusion-title-text fusion-title-size-one meit-h1\" style=\"--awb-margin-top:0px;--awb-margin-bottom:18px;--awb-margin-top-small:10px;--awb-margin-right-small:0px;--awb-margin-bottom-small:10px;--awb-margin-left-small:0px;\"><h1 class=\"fusion-title-heading title-heading-left\" style=\"margin:0;\">Is your website still running the <mark>old PHP?<\/mark><\/h1><\/div><div class=\"fusion-text fusion-text-3 fusion-text-no-margin meit-lead\" style=\"--awb-margin-top:0px;--awb-margin-bottom:0px;\"><p>The PHP project has fixed two critical vulnerabilities, now known as \u00abphp2shell\u00bb, both rated 9.2 out of 10. Without the update, an attacker can run their own code on your web server without a password. Almost every WordPress website is affected. Find out in ten seconds what your website reveals.<\/p>\n<\/div><style>\n.mpc{--mpc-acc:#ffe066;--mpc-line:rgba(255,255,255,.12);--mpc-mut:#8592b0;--mpc-red:#ff6b5e;--mpc-green:#5fd39a;--mpc-grey:#a9b3c9;color:#fff;max-width:760px;margin-top:28px}\n.mpc *{box-sizing:border-box}\n.mpc-form{display:flex;gap:6px;background:rgba(255,255,255,.06);border:1px solid var(--mpc-line);border-radius:999px;padding:6px;max-width:560px}\n.mpc-form input{flex:1;min-width:0;background:transparent;border:0;color:#fff;font:inherit;font-size:16px;padding:10px 14px;outline:none}\n.mpc-form input::placeholder{color:var(--mpc-mut)}\n.mpc-btn{background:var(--mpc-acc);color:#060b1c;border:0;border-radius:999px;font-weight:700;font-size:15px;line-height:1;padding:13px 20px;cursor:pointer;white-space:nowrap}\n.mpc-btn[disabled]{opacity:.6;cursor:wait}\n.mpc-fine{font-family:\"JetBrains Mono\",ui-monospace,monospace;font-size:11px;letter-spacing:.06em;text-transform:uppercase;color:var(--mpc-mut);margin-top:12px;display:flex;gap:8px;align-items:center}\n.mpc-fine:before{content:\"\";width:6px;height:6px;border-radius:50%;background:var(--mpc-green);flex:none}\n.mpc-res{margin-top:26px}\n.mpc-r{border-radius:22px;border:1px solid var(--mpc-line);background:rgba(255,255,255,.04);padding:24px;display:grid;grid-template-columns:auto 1fr;gap:16px 20px}\n@media(max-width:640px){.mpc-r{grid-template-columns:1fr}}\n.mpc-badge{width:60px;height:60px;border-radius:16px;display:grid;place-items:center;font-weight:800;font-size:26px}\n.mpc-offen{border-color:rgba(255,107,94,.5)}.mpc-offen .mpc-badge{background:rgba(255,107,94,.15);color:var(--mpc-red)}\n.mpc-aktuell{border-color:rgba(95,211,154,.45)}.mpc-aktuell .mpc-badge{background:rgba(95,211,154,.14);color:var(--mpc-green)}\n.mpc-verborgen .mpc-badge,.mpc-fehler .mpc-badge{background:rgba(169,179,201,.12);color:var(--mpc-grey)}\n.mpc-r h3{margin:0 0 8px;font-size:clamp(21px,2.6vw,28px);line-height:1.15;letter-spacing:-.02em;color:#fff}\n.mpc-r p{margin:0 0 10px;color:#c9d0e0}\n.mpc-meta{font-family:\"JetBrains Mono\",ui-monospace,monospace;font-size:12px;color:var(--mpc-mut);margin-bottom:6px}\n.mpc-steps{margin:4px 0 0;padding-left:20px;color:#c9d0e0}.mpc-steps li{margin:4px 0}\n.mpc-lead{grid-column:1\/-1;border-top:1px solid var(--mpc-line);padding-top:18px}\n.mpc-lead h4{margin:0 0 4px;font-size:19px;color:#fff}\n.mpc-grid{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:12px}@media(max-width:640px){.mpc-grid{grid-template-columns:1fr}}\n.mpc-grid input{background:rgba(255,255,255,.05);border:1px solid var(--mpc-line);border-radius:12px;color:#fff;font:inherit;padding:12px 14px;min-width:0}\n.mpc-hp{position:absolute!important;left:-9999px!important;width:1px;height:1px;opacity:0}\n.mpc-consent{display:flex;gap:10px;align-items:flex-start;font-size:13px;color:var(--mpc-mut);margin:12px 0 14px}.mpc-consent input{margin-top:3px;accent-color:var(--mpc-acc)}\n.mpc-consent a{color:var(--mpc-mut);text-decoration:underline}\n.mpc-ok{color:var(--mpc-green);font-weight:600;margin:0}\n.mpc-err{color:var(--mpc-red);font-size:14px;margin:8px 0 0}\n<\/style>\n<div class=\"mpc\" id=\"mpc\">\n  <form class=\"mpc-form\" id=\"mpc-form\" novalidate>\n    <input id=\"mpc-url\" name=\"url\" placeholder=\"yourcompany.ch\" autocomplete=\"url\" inputmode=\"url\" aria-label=\"Your website address\" required>\n    <button class=\"mpc-btn\" id=\"mpc-go\" type=\"submit\">Check now \u2192<\/button>\n  <\/form>\n  <div class=\"mpc-fine\">Free \u00b7 no sign-up \u00b7 a single request to your homepage<\/div>\n  <div class=\"mpc-res\" id=\"mpc-res\" aria-live=\"polite\"><\/div>\n<\/div>\n<div class=\"fusion-text fusion-text-4 fusion-text-no-margin meit-updated\" style=\"--awb-margin-top:26px;--awb-margin-bottom:0px;\"><p>As of 22 October 2026<\/p>\n<\/div><\/div><\/div><\/div><\/section><div id=\"versions\" class=\"fusion-container-anchor\"><section class=\"fusion-fullwidth fullwidth-box fusion-builder-row-2 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling meit-sec meit-fragen\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-padding-top:clamp(72px,8vw,120px);--awb-padding-right:clamp(20px,4vw,48px);--awb-padding-bottom:clamp(56px,6vw,88px);--awb-padding-left:clamp(20px,4vw,48px);--awb-margin-top:0px;--awb-margin-bottom:0px;--awb-background-color:var(--awb-color2);--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:calc( 1080px + 16px );margin-left: calc(-16px \/ 2 );margin-right: calc(-16px \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-1 fusion_builder_column_1_1 1_1 fusion-flex-column fusion-flex-align-self-stretch\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:8px;--awb-margin-bottom-large:20px;--awb-spacing-left-large:8px;--awb-width-medium:100%;--awb-spacing-right-medium:8px;--awb-spacing-left-medium:8px;--awb-width-small:100%;--awb-spacing-right-small:8px;--awb-spacing-left-small:8px;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-5 fusion-text-no-margin meit-eyebrow\" style=\"--awb-margin-top:0px;--awb-margin-bottom:18px;\"><p>Safe from<\/p>\n<\/div><div class=\"fusion-title title fusion-title-2 fusion-sep-none fusion-title-text fusion-title-size-two meit-h2\" style=\"--awb-margin-top:0px;--awb-margin-bottom:18px;--awb-margin-top-small:10px;--awb-margin-right-small:0px;--awb-margin-bottom-small:10px;--awb-margin-left-small:0px;\"><h2 class=\"fusion-title-heading title-heading-left\" style=\"margin:0;\">These versions are <mark>fixed<\/mark>.<\/h2><\/div><div class=\"fusion-text fusion-text-6 fusion-text-no-margin meit-lead\" style=\"--awb-margin-top:0px;--awb-margin-bottom:8px;\"><p>Safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or newer. PHP 8.1 and older no longer receive a fix from the PHP project, and PHP 8.2 receives no security updates after 31 December 2026.<\/p>\n<\/div><\/div><\/div><\/div><\/section><\/div><div id=\"background\" class=\"fusion-container-anchor\"><section class=\"fusion-fullwidth fullwidth-box fusion-builder-row-3 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling meit-sec meit-systeme\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-padding-top:0px;--awb-padding-right:clamp(20px,4vw,48px);--awb-padding-bottom:clamp(72px,8vw,120px);--awb-padding-left:clamp(20px,4vw,48px);--awb-margin-top:0px;--awb-margin-bottom:0px;--awb-background-color:var(--awb-color2);--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:calc( 1080px + 16px );margin-left: calc(-16px \/ 2 );margin-right: calc(-16px \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-2 fusion_builder_column_1_3 1_3 fusion-flex-column fusion-flex-align-self-stretch meit-card\" style=\"--awb-bg-size:cover;--awb-width-large:33.333333333333%;--awb-margin-top-large:0px;--awb-spacing-right-large:8px;--awb-margin-bottom-large:20px;--awb-spacing-left-large:8px;--awb-width-medium:33.333333333333%;--awb-spacing-right-medium:8px;--awb-spacing-left-medium:8px;--awb-width-small:100%;--awb-spacing-right-small:8px;--awb-spacing-left-small:8px;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-3 fusion-sep-none fusion-title-text fusion-title-size-three\" style=\"--awb-margin-top:0px;--awb-margin-bottom:10px;--awb-margin-top-small:10px;--awb-margin-right-small:0px;--awb-margin-bottom-small:10px;--awb-margin-left-small:0px;\"><h3 class=\"fusion-title-heading title-heading-left\" style=\"margin:0;\">No password needed<\/h3><\/div><div class=\"fusion-text fusion-text-7 fusion-text-no-margin\" style=\"--awb-margin-top:0px;--awb-margin-bottom:0px;\"><p>A single crafted request to the web server can be enough. The PHP project rates the risk highest for Apache with mod_php.<\/p>\n<\/div><\/div><\/div><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-3 fusion_builder_column_1_3 1_3 fusion-flex-column fusion-flex-align-self-stretch meit-card\" style=\"--awb-bg-size:cover;--awb-width-large:33.333333333333%;--awb-margin-top-large:0px;--awb-spacing-right-large:8px;--awb-margin-bottom-large:20px;--awb-spacing-left-large:8px;--awb-width-medium:33.333333333333%;--awb-spacing-right-medium:8px;--awb-spacing-left-medium:8px;--awb-width-small:100%;--awb-spacing-right-small:8px;--awb-spacing-left-small:8px;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-4 fusion-sep-none fusion-title-text fusion-title-size-three\" style=\"--awb-margin-top:0px;--awb-margin-bottom:10px;--awb-margin-top-small:10px;--awb-margin-right-small:0px;--awb-margin-bottom-small:10px;--awb-margin-left-small:0px;\"><h3 class=\"fusion-title-heading title-heading-left\" style=\"margin:0;\">Only the update protects<\/h3><\/div><div class=\"fusion-text fusion-text-8 fusion-text-no-margin\" style=\"--awb-margin-top:0px;--awb-margin-bottom:0px;\"><p>\u00abUpdating is the only safe choice\u00bb, writes php.net. Changed settings lower the risk, but they do not make an installation safe.<\/p>\n<\/div><\/div><\/div><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-4 fusion_builder_column_1_3 1_3 fusion-flex-column fusion-flex-align-self-stretch meit-card\" style=\"--awb-bg-size:cover;--awb-width-large:33.333333333333%;--awb-margin-top-large:0px;--awb-spacing-right-large:8px;--awb-margin-bottom-large:20px;--awb-spacing-left-large:8px;--awb-width-medium:33.333333333333%;--awb-spacing-right-medium:8px;--awb-spacing-left-medium:8px;--awb-width-small:100%;--awb-spacing-right-small:8px;--awb-spacing-left-small:8px;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-5 fusion-sep-none fusion-title-text fusion-title-size-three\" style=\"--awb-margin-top:0px;--awb-margin-bottom:10px;--awb-margin-top-small:10px;--awb-margin-right-small:0px;--awb-margin-bottom-small:10px;--awb-margin-left-small:0px;\"><h3 class=\"fusion-title-heading title-heading-left\" style=\"margin:0;\">Not just the website<\/h3><\/div><div class=\"fusion-text fusion-text-9 fusion-text-no-margin\" style=\"--awb-margin-top:0px;--awb-margin-bottom:0px;\"><p>The Swiss Federal Office for Cybersecurity advises checking applications and devices that contain PHP as well, such as network storage, intranets or booking systems.<\/p>\n<\/div><\/div><\/div><\/div><\/section><\/div><div id=\"faq\" class=\"fusion-container-anchor\"><section class=\"fusion-fullwidth fullwidth-box fusion-builder-row-4 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling meit-sec meit-faq\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-padding-top:clamp(72px,8vw,120px);--awb-padding-right:clamp(20px,4vw,48px);--awb-padding-bottom:clamp(72px,8vw,120px);--awb-padding-left:clamp(20px,4vw,48px);--awb-margin-top:0px;--awb-margin-bottom:0px;--awb-background-color:var(--awb-color1);--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:calc( 1080px + 16px );margin-left: calc(-16px \/ 2 );margin-right: calc(-16px \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-5 fusion_builder_column_1_1 1_1 fusion-flex-column fusion-flex-align-self-stretch\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:8px;--awb-margin-bottom-large:20px;--awb-spacing-left-large:8px;--awb-width-medium:100%;--awb-spacing-right-medium:8px;--awb-spacing-left-medium:8px;--awb-width-small:100%;--awb-spacing-right-small:8px;--awb-spacing-left-small:8px;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-10 fusion-text-no-margin meit-eyebrow\" style=\"--awb-margin-top:0px;--awb-margin-bottom:18px;\"><p>Questions<\/p>\n<\/div><div class=\"fusion-title title fusion-title-6 fusion-sep-none fusion-title-text fusion-title-size-two meit-h2\" style=\"--awb-margin-top:0px;--awb-margin-bottom:0px;--awb-margin-top-small:10px;--awb-margin-right-small:0px;--awb-margin-bottom-small:10px;--awb-margin-left-small:0px;\"><h2 class=\"fusion-title-heading title-heading-left\" style=\"margin:0;\">Frequently asked <mark>questions<\/mark>.<\/h2><\/div><div class=\"accordian fusion-accordian meit-faq\" style=\"margin-top:32px;--awb-margin-top:32px;--awb-border-size:1px;--awb-icon-size:20px;--awb-content-font-size:var(--awb-typography4-font-size);--awb-icon-alignment:right;--awb-hover-color:rgba(0,0,0,0);--awb-border-color:var(--awb-color3);--awb-background-color:var(--awb-color1);--awb-divider-color:rgba(10,22,51,.13);--awb-divider-hover-color:var(--awb-color3);--awb-icon-color:var(--awb-color5);--awb-title-color:var(--awb-color8);--awb-content-color:var(--awb-color8);--awb-icon-box-color:var(--awb-color8);--awb-toggle-hover-accent-color:var(--awb-color5);--awb-title-font-family:var(--awb-typography1-font-family);--awb-title-font-weight:var(--awb-typography1-font-weight);--awb-title-font-style:var(--awb-typography1-font-style);--awb-title-font-size:16px;--awb-content-font-family:var(--awb-typography4-font-family);--awb-content-font-weight:var(--awb-typography4-font-weight);--awb-content-font-style:var(--awb-typography4-font-style);\"><div class=\"panel-group fusion-toggle-icon-right fusion-toggle-icon-boxed\" id=\"accordion-1180-1\"><div class=\"fusion-panel panel-default panel-7cdce26ad1bc4ae3e fusion-toggle-has-divider\"><div class=\"panel-heading\"><h4 class=\"panel-title toggle\" id=\"toggle_7cdce26ad1bc4ae3e\"><a class=\"active\" aria-expanded=\"true\" aria-controls=\"7cdce26ad1bc4ae3e\" role=\"button\" data-toggle=\"collapse\" data-parent=\"#accordion-1180-1\" data-target=\"#7cdce26ad1bc4ae3e\" href=\"#7cdce26ad1bc4ae3e\"><span class=\"fusion-toggle-icon-wrapper\" aria-hidden=\"true\"><i class=\"fa-fusion-box active-icon awb-icon-minus\" aria-hidden=\"true\"><\/i><i class=\"fa-fusion-box inactive-icon awb-icon-plus\" aria-hidden=\"true\"><\/i><\/span><span class=\"fusion-toggle-heading\">How does the check work?<\/span><\/a><\/h4><\/div><div id=\"7cdce26ad1bc4ae3e\" class=\"panel-collapse collapse in\" aria-labelledby=\"toggle_7cdce26ad1bc4ae3e\"><div class=\"panel-body toggle-content fusion-clearfix\">\n<p>We request the homepage of your website exactly once, just like any browser does, and read the PHP version that many servers include in their response. We do not attack, we do not scan, and we keep the checked address in a cache for 15 minutes only.<\/p>\n<\/div><\/div><\/div><div class=\"fusion-panel panel-default panel-192e78a77ab95eada fusion-toggle-has-divider\"><div class=\"panel-heading\"><h4 class=\"panel-title toggle\" id=\"toggle_192e78a77ab95eada\"><a aria-expanded=\"false\" aria-controls=\"192e78a77ab95eada\" role=\"button\" data-toggle=\"collapse\" data-parent=\"#accordion-1180-1\" data-target=\"#192e78a77ab95eada\" href=\"#192e78a77ab95eada\"><span class=\"fusion-toggle-icon-wrapper\" aria-hidden=\"true\"><i class=\"fa-fusion-box active-icon awb-icon-minus\" aria-hidden=\"true\"><\/i><i class=\"fa-fusion-box inactive-icon awb-icon-plus\" aria-hidden=\"true\"><\/i><\/span><span class=\"fusion-toggle-heading\">What does \u00abversion not visible\u00bb mean?<\/span><\/a><\/h4><\/div><div id=\"192e78a77ab95eada\" class=\"panel-collapse collapse \" aria-labelledby=\"toggle_192e78a77ab95eada\"><div class=\"panel-body toggle-content fusion-clearfix\">\n<p>Your server does not reveal its PHP version. That is good practice, but it says nothing about whether the update is installed. In WordPress you find the version under Tools \u203a Site Health \u203a Info \u203a Server. Or ask your host.<\/p>\n<\/div><\/div><\/div><div class=\"fusion-panel panel-default panel-0d1ddc22ae3b6d521 fusion-toggle-has-divider\"><div class=\"panel-heading\"><h4 class=\"panel-title toggle\" id=\"toggle_0d1ddc22ae3b6d521\"><a aria-expanded=\"false\" aria-controls=\"0d1ddc22ae3b6d521\" role=\"button\" data-toggle=\"collapse\" data-parent=\"#accordion-1180-1\" data-target=\"#0d1ddc22ae3b6d521\" href=\"#0d1ddc22ae3b6d521\"><span class=\"fusion-toggle-icon-wrapper\" aria-hidden=\"true\"><i class=\"fa-fusion-box active-icon awb-icon-minus\" aria-hidden=\"true\"><\/i><i class=\"fa-fusion-box inactive-icon awb-icon-plus\" aria-hidden=\"true\"><\/i><\/span><span class=\"fusion-toggle-heading\">Can the result be wrong?<\/span><\/a><\/h4><\/div><div id=\"0d1ddc22ae3b6d521\" class=\"panel-collapse collapse \" aria-labelledby=\"toggle_0d1ddc22ae3b6d521\"><div class=\"panel-body toggle-content fusion-clearfix\">\n<p>Yes, in two cases. Some Linux distributions apply fixes without changing the version number. And a different server may sit in front of the one that generates the page. The check is a quick first indication, not a guarantee. What counts is your host&#8217;s confirmation.<\/p>\n<\/div><\/div><\/div><div class=\"fusion-panel panel-default panel-76e1843df1db2f282 fusion-toggle-has-divider\"><div class=\"panel-heading\"><h4 class=\"panel-title toggle\" id=\"toggle_76e1843df1db2f282\"><a aria-expanded=\"false\" aria-controls=\"76e1843df1db2f282\" role=\"button\" data-toggle=\"collapse\" data-parent=\"#accordion-1180-1\" data-target=\"#76e1843df1db2f282\" href=\"#76e1843df1db2f282\"><span class=\"fusion-toggle-icon-wrapper\" aria-hidden=\"true\"><i class=\"fa-fusion-box active-icon awb-icon-minus\" aria-hidden=\"true\"><\/i><i class=\"fa-fusion-box inactive-icon awb-icon-plus\" aria-hidden=\"true\"><\/i><\/span><span class=\"fusion-toggle-heading\">What does the check by Meit cost?<\/span><\/a><\/h4><\/div><div id=\"76e1843df1db2f282\" class=\"panel-collapse collapse \" aria-labelledby=\"toggle_76e1843df1db2f282\"><div class=\"panel-body toggle-content fusion-clearfix\">\n<p>Nothing. We review your website by hand, tell you what to do and whether your host has installed the update. It only turns into an assignment if you want it to.<\/p>\n<\/div><\/div><\/div><div class=\"fusion-panel panel-default panel-4cf2bf6ac9af82ae5 fusion-toggle-has-divider\"><div class=\"panel-heading\"><h4 class=\"panel-title toggle\" id=\"toggle_4cf2bf6ac9af82ae5\"><a aria-expanded=\"false\" aria-controls=\"4cf2bf6ac9af82ae5\" role=\"button\" data-toggle=\"collapse\" data-parent=\"#accordion-1180-1\" data-target=\"#4cf2bf6ac9af82ae5\" href=\"#4cf2bf6ac9af82ae5\"><span class=\"fusion-toggle-icon-wrapper\" aria-hidden=\"true\"><i class=\"fa-fusion-box active-icon awb-icon-minus\" aria-hidden=\"true\"><\/i><i class=\"fa-fusion-box inactive-icon awb-icon-plus\" aria-hidden=\"true\"><\/i><\/span><span class=\"fusion-toggle-heading\">What is php2shell?<\/span><\/a><\/h4><\/div><div id=\"4cf2bf6ac9af82ae5\" class=\"panel-collapse collapse \" aria-labelledby=\"toggle_4cf2bf6ac9af82ae5\"><div class=\"panel-body toggle-content fusion-clearfix\">\n<p>That is the name of the two critical vulnerabilities in PHP that the PHP project fixed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10. They let attackers run their own code on a web server without a password.<\/p>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fusion-text fusion-text-11 fusion-text-no-margin meit-updated\" style=\"--awb-margin-top:28px;--awb-margin-bottom:0px;\"><p>Sources: <a href=\"https:\/\/www.php.net\/\" target=\"_blank\" rel=\"noopener\">php.net<\/a>, release announcements 8.5.12, 8.4.27, 8.3.36 and 8.2.35 of 21 October 2026 \u00b7 <a href=\"https:\/\/www.nsa.gov\/Press-Room\/Press-Releases-Statements\/Press-Release-View\/Article\/4630238\/nsa-advisory-php-updates\/\" target=\"_blank\" rel=\"noopener\">NSA Advisory: PHP Updates<\/a> \u00b7 Background (in German) at <a href=\"https:\/\/www.leitgrad.ch\/php2shell-cyon-hostpoint-websites-offline-kmu\/\" target=\"_blank\" rel=\"noopener\">Leitgrad<\/a>. The check is an indication without warranty.<\/p>\n<\/div><script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"inLanguage\": \"en\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"How does the check work?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"We request the homepage of your website exactly once, just like any browser does, and read the PHP version that many servers include in their response. We do not attack, we do not scan, and we keep the checked address in a cache for 15 minutes only.\"}}, {\"@type\": \"Question\", \"name\": \"What does \u00abversion not visible\u00bb mean?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Your server does not reveal its PHP version. That is good practice, but it says nothing about whether the update is installed. In WordPress you find the version under Tools \u203a Site Health \u203a Info \u203a Server. Or ask your host.\"}}, {\"@type\": \"Question\", \"name\": \"Can the result be wrong?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes, in two cases. Some Linux distributions apply fixes without changing the version number. And a different server may sit in front of the one that generates the page. The check is a quick first indication, not a guarantee. What counts is your host's confirmation.\"}}, {\"@type\": \"Question\", \"name\": \"What does the check by Meit cost?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Nothing. We review your website by hand, tell you what to do and whether your host has installed the update. It only turns into an assignment if you want it to.\"}}, {\"@type\": \"Question\", \"name\": \"What is php2shell?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"That is the name of the two critical vulnerabilities in PHP that the PHP project fixed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10. They let attackers run their own code on a web server without a password.\"}}]}<\/script><\/div><\/div><\/div><\/section><\/div><section class=\"fusion-fullwidth fullwidth-box fusion-builder-row-5 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling meit-sec meit-dark meit-ctaband\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-padding-top:clamp(64px,7vw,96px);--awb-padding-right:clamp(20px,4vw,48px);--awb-padding-bottom:clamp(64px,7vw,96px);--awb-padding-left:clamp(20px,4vw,48px);--awb-margin-top:0px;--awb-margin-bottom:0px;--awb-background-color:var(--awb-color8);--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:calc( 1080px + 16px );margin-left: calc(-16px \/ 2 );margin-right: calc(-16px \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-6 fusion_builder_column_1_1 1_1 fusion-flex-column fusion-flex-align-self-stretch\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:8px;--awb-margin-bottom-large:20px;--awb-spacing-left-large:8px;--awb-width-medium:100%;--awb-spacing-right-medium:8px;--awb-spacing-left-medium:8px;--awb-width-small:100%;--awb-spacing-right-small:8px;--awb-spacing-left-small:8px;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-7 fusion-sep-none fusion-title-text fusion-title-size-two meit-h2\" style=\"--awb-margin-top:0px;--awb-margin-bottom:14px;--awb-margin-top-small:10px;--awb-margin-right-small:0px;--awb-margin-bottom-small:10px;--awb-margin-left-small:0px;\"><h2 class=\"fusion-title-heading title-heading-left\" style=\"margin:0;\">Rather talk <mark>directly?<\/mark><\/h2><\/div><div class=\"fusion-text fusion-text-12 fusion-text-no-margin meit-lead\" style=\"--awb-margin-top:0px;--awb-margin-bottom:22px;\"><p>30 minutes with Merag Shahzad: together we look at where your website stands and what your host needs to do.<\/p>\n<\/div><div style=\"text-align:left;\"><a class=\"fusion-button button-flat fusion-button-default-size button-default fusion-button-default button-1 fusion-button-default-span fusion-button-default-type\" style=\"--button_text_transform:none;\" target=\"_self\" href=\"\/en\/contact\/\"><span class=\"fusion-button-text awb-button__text awb-button__text--default\">Book a call<\/span><\/a><\/div><\/div><\/div><\/div><\/section><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"100-width.php","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-1180","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>PHP Check: Is your website affected by php2shell? - meit<\/title>\n<meta name=\"description\" content=\"Free check in ten seconds: does your website reveal an outdated PHP version? Safe versions, what to do now and a free expert review by Meit.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.meit.ch\/en\/php-check\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PHP Check: Is your website affected by php2shell? - meit\" \/>\n<meta property=\"og:description\" content=\"Free check in ten seconds: does your website reveal an outdated PHP version? Safe versions, what to do now and a free expert review by Meit.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.meit.ch\/en\/php-check\/\" \/>\n<meta property=\"og:site_name\" content=\"meit\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T20:55:22+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/php-check\\\/\",\"url\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/php-check\\\/\",\"name\":\"PHP Check: Is your website affected by php2shell? - meit\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/#website\"},\"datePublished\":\"2026-10-22T20:43:07+00:00\",\"dateModified\":\"2026-10-22T20:55:22+00:00\",\"description\":\"Free check in ten seconds: does your website reveal an outdated PHP version? Safe versions, what to do now and a free expert review by Meit.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/php-check\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.meit.ch\\\/en\\\/php-check\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/php-check\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PHP Check: Is your website affected by php2shell?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/\",\"name\":\"meit - GEO Agentur & SEO\",\"description\":\"GEO &amp; SEO Agentur Z\u00fcrich f\u00fcr ambitionierte Unternehmen\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Organization\",\"ProfessionalService\"],\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/#organization\",\"name\":\"meit\",\"url\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.meit.ch\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/ms-edge-icon-270x270-1.png\",\"contentUrl\":\"https:\\\/\\\/www.meit.ch\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/ms-edge-icon-270x270-1.png\",\"width\":270,\"height\":270,\"caption\":\"meit - GEO Agentur & SEO\"},\"image\":{\"@id\":\"https:\\\/\\\/www.meit.ch\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"alternateName\":\"meit - GEO & SEO Agentur Z\u00fcrich\",\"legalName\":\"meit - Merag Shahzad\",\"description\":\"GEO- und SEO-Agentur in Z\u00fcrich f\u00fcr ambitionierte Unternehmen. Sichtbarkeit in KI-Antworten und in der Google-Suche, messbar belegt.\",\"telephone\":\"+41 44 688 04 48\",\"email\":\"kontakt@meit.ch\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Strehlgasse 2\",\"postalCode\":\"8001\",\"addressLocality\":\"Z\u00fcrich\",\"addressRegion\":\"ZH\",\"addressCountry\":\"CH\"},\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer service\",\"telephone\":\"+41 44 688 04 48\",\"email\":\"kontakt@meit.ch\",\"areaServed\":[\"CH\",\"DE\",\"AT\"],\"availableLanguage\":[\"de\",\"en\",\"fr\"]}],\"openingHoursSpecification\":[{\"@type\":\"OpeningHoursSpecification\",\"dayOfWeek\":[\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\"],\"opens\":\"09:00\",\"closes\":\"18:00\"}],\"areaServed\":[{\"@type\":\"Country\",\"name\":\"Schweiz\"},{\"@type\":\"Country\",\"name\":\"Deutschland\"},{\"@type\":\"Country\",\"name\":\"\u00d6sterreich\"}],\"founder\":{\"@type\":\"Person\",\"name\":\"Merag Shahzad\"},\"knowsAbout\":[\"Generative Engine Optimization\",\"Suchmaschinenoptimierung\",\"KI-Sichtbarkeit\",\"Narrative Management\",\"ChatGPT Ads\"],\"knowsLanguage\":[\"de\",\"en\",\"fr\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PHP Check: Is your website affected by php2shell? - meit","description":"Free check in ten seconds: does your website reveal an outdated PHP version? Safe versions, what to do now and a free expert review by Meit.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.meit.ch\/en\/php-check\/","og_locale":"en_US","og_type":"article","og_title":"PHP Check: Is your website affected by php2shell? - meit","og_description":"Free check in ten seconds: does your website reveal an outdated PHP version? Safe versions, what to do now and a free expert review by Meit.","og_url":"https:\/\/www.meit.ch\/en\/php-check\/","og_site_name":"meit","article_modified_time":"2026-10-22T20:55:22+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.meit.ch\/en\/php-check\/","url":"https:\/\/www.meit.ch\/en\/php-check\/","name":"PHP Check: Is your website affected by php2shell? - meit","isPartOf":{"@id":"https:\/\/www.meit.ch\/en\/#website"},"datePublished":"2026-10-22T20:43:07+00:00","dateModified":"2026-10-22T20:55:22+00:00","description":"Free check in ten seconds: does your website reveal an outdated PHP version? Safe versions, what to do now and a free expert review by Meit.","breadcrumb":{"@id":"https:\/\/www.meit.ch\/en\/php-check\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.meit.ch\/en\/php-check\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.meit.ch\/en\/php-check\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/www.meit.ch\/en\/"},{"@type":"ListItem","position":2,"name":"PHP Check: Is your website affected by php2shell?"}]},{"@type":"WebSite","@id":"https:\/\/www.meit.ch\/en\/#website","url":"https:\/\/www.meit.ch\/en\/","name":"meit - GEO Agentur & SEO","description":"GEO &amp; SEO Agentur Z\u00fcrich f\u00fcr ambitionierte Unternehmen","publisher":{"@id":"https:\/\/www.meit.ch\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.meit.ch\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Organization","ProfessionalService"],"@id":"https:\/\/www.meit.ch\/en\/#organization","name":"meit","url":"https:\/\/www.meit.ch\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.meit.ch\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.meit.ch\/wp-content\/uploads\/2026\/07\/ms-edge-icon-270x270-1.png","contentUrl":"https:\/\/www.meit.ch\/wp-content\/uploads\/2026\/07\/ms-edge-icon-270x270-1.png","width":270,"height":270,"caption":"meit - GEO Agentur & SEO"},"image":{"@id":"https:\/\/www.meit.ch\/en\/#\/schema\/logo\/image\/"},"alternateName":"meit - GEO & SEO Agentur Z\u00fcrich","legalName":"meit - Merag Shahzad","description":"GEO- und SEO-Agentur in Z\u00fcrich f\u00fcr ambitionierte Unternehmen. Sichtbarkeit in KI-Antworten und in der Google-Suche, messbar belegt.","telephone":"+41 44 688 04 48","email":"kontakt@meit.ch","address":{"@type":"PostalAddress","streetAddress":"Strehlgasse 2","postalCode":"8001","addressLocality":"Z\u00fcrich","addressRegion":"ZH","addressCountry":"CH"},"contactPoint":[{"@type":"ContactPoint","contactType":"customer service","telephone":"+41 44 688 04 48","email":"kontakt@meit.ch","areaServed":["CH","DE","AT"],"availableLanguage":["de","en","fr"]}],"openingHoursSpecification":[{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday"],"opens":"09:00","closes":"18:00"}],"areaServed":[{"@type":"Country","name":"Schweiz"},{"@type":"Country","name":"Deutschland"},{"@type":"Country","name":"\u00d6sterreich"}],"founder":{"@type":"Person","name":"Merag Shahzad"},"knowsAbout":["Generative Engine Optimization","Suchmaschinenoptimierung","KI-Sichtbarkeit","Narrative Management","ChatGPT Ads"],"knowsLanguage":["de","en","fr"]}]}},"_links":{"self":[{"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/pages\/1180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/comments?post=1180"}],"version-history":[{"count":2,"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/pages\/1180\/revisions"}],"predecessor-version":[{"id":1182,"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/pages\/1180\/revisions\/1182"}],"wp:attachment":[{"href":"https:\/\/www.meit.ch\/en\/wp-json\/wp\/v2\/media?parent=1180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}