Free website safety check
Is your website safe from the PHP2Shell flaws?
PHP2Shell is a pair of critical flaws in PHP, the language behind about 7 in 10 websites. They let an attacker run code on a server without logging in. Fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Send us your website and the PixelRidge team will check it for free and tell you in plain words what, if anything, needs doing.
What's happening · updated 24 October 2026
Governments are switching sites off. Your business can't.
United Kingdom
The National Cyber Security Centre sent more than 50,000 warnings to UK organisations, and ministers said 32 government services were unavailable.
Source: ITV News, 22 OctGermany
The federal cyber security office (BSI) rated the risk "extraordinarily high". The city of Mainz switched off its main website as a precaution.
Source: ZDFheute, 21 OctUSA and Canada
CISA and the Canadian Centre for Cyber Security both issued alerts on 21 October telling organisations to update PHP right away.
Source: Canadian Centre for Cyber SecurityAttacks
Cloudflare's CEO said it saw hundreds of thousands of hacking attempts within two hours of the announcement, and Amazon Web Services said the flaw is being broadly exploited.
Source: ITV News, 22 OctCheck yourself
3 signs your website runs on PHP.
Sign 1
Page addresses end in .php
Links like yoursite.com/contact.php or index.php mean the site runs on PHP.
Sign 2
Built on WordPress, Joomla or Drupal
These all run on PHP. If you log in at yoursite.com/wp-admin, your site is WordPress.
Sign 3
Your hosting panel has a "PHP version" setting
Common on cPanel and shared hosting. If it shows 8.1 or older, that version gets no fix for these flaws.
The free check
What the PixelRidge team looks at.
What your site runs on
Whether your site uses PHP, which platform it's built on and, where it shows, which PHP version.
Whether it's on a fixed version
PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. Older branches like 8.1 and 7.x get no fix.
Plugins and add-ons
Out-of-date plugins and themes that are a common way in, even after PHP is patched.
A plain answer
A short written reply: looks fine, needs a patch, or needs a move. If paid work is needed, you get a fixed written price first.
We only check websites you own or manage, and nothing is tested beyond what's public without your OK.
If it needs work
Three ways we deal with it.
Option 1
Patch
Update PHP to a fixed version on your current hosting, and update the platform and plugins.
Option 2
Update your code
Fix old code that breaks on a newer PHP version, so the update doesn't take your site down.
Option 3
Move to a safer home
Move the site to modern hosting you own, or rebuild it on a setup that doesn't run PHP at all.
Moving is handled by our Rescue & Migration service, and a site that has already been hacked by Hacked Site Rescue. Every job gets a fixed written price before paid work starts.
Questions
Common questions about PHP2Shell
What is PHP2Shell?
PHP2Shell is the nickname for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, whose details leaked on 20 October 2026; fixes were released on 21 October. They can let an attacker run code on a web server without logging in.
Is my website affected?
Only if it runs on PHP and the server hasn't been updated to a fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer). WordPress, Joomla and Drupal sites run on PHP. Many site builders and modern hosts don't. The free check tells you which applies to you.
Is the check really free?
Yes. We look at your site and send you a short written answer. You only pay if you choose to have us do the work, and you get a fixed written price before anything starts.
Do you need my passwords?
No. Please don't send passwords through the form. We start from what's public. If we need to see your hosting settings, we'll explain how to give us safe, temporary access.
What if my site has already been hacked?
Tell us what you see in the form. Our Hacked Site Rescue service cleans the site, closes the way in and gets Google warnings removed.
Get your free check
Add your website's address and anything you know about how it's built or hosted. The PixelRidge team replies within 2 working days. Please don't send passwords.