Critical PHP security advisory issued Oct 21, 2026. Fixed versions are out. Most site owners don't know which one they're running.

DABDEPLOY AI BOTS

Veteran-owned

NSA Advisory · Oct 21, 2026

Business owners: Is your website exposed to PHP2Shell?

Two critical flaws in PHP, the software behind most websites including WordPress, can let an attacker take over a web server without a password. Enter your domain and we'll tell you if your site looks exposed, and exactly what to do about it.

Passive outside check. No login, no plugin, nothing installed.
Plain-English result, plus the message to send your host or developer.
Run by a former U.S. Army Cyber Security Officer.

Fixes released --

Free · 30 seconds

Check my website

Tell us which site to check and where to send your results.

Something went wrong running your check. Please try again.

Website address

https://

Enter a valid website, like yourbusiness.com

First name

Enter your first name

Phone

Enter a valid phone number

Email for your results

Enter a valid email address

No login needed Nothing installed ~30 seconds

What Happened On October 21st

2Critical flaws
in PHP itself

9.2/10Severity score
(CVSS v4.0)

0Passwords an attacker
needs to try it

The NSA told organizations to patch now

Its advisory warns that attackers are likely to weaponize these flaws, nicknamed "PHP2Shell," and could use them to steal data, knock services offline, or move deeper into a network.

It's the server, not your website's design

The flaws are in PHP, the engine running underneath the site. A clean, well-built website on an unpatched server is still exposed.

Updating is the only real fix

PHP released fixed versions the same day. Its security team says temporary workarounds only reduce some risk and don't make a server safe.

Sources: NSA press release · PHP.net security advisory

Is Your PHP Version Patched?

Don't know which version you're on? That's exactly what the free check finds out.

VersionSafe once you're onStatus

PHP 8.5

8.5.12 or newer

Fix available

PHP 8.4

8.4.27 or newer

Fix available

PHP 8.3

8.3.36 or newer

Fix available

PHP 8.2

8.2.35 or newer8.2 stops getting security fixes Dec 31, 2026. Plan your upgrade.

Fix available

PHP 8.1 & older

No official update. Upgrade to a supported version, or ask your host whether they've applied a backported fix.

Highest risk

You Should Check If Any Of These Sound Familiar

Your site runs on WordPress

WordPress, WooCommerce, Joomla, Drupal and Magento all run on PHP.

Your web person moved on

The site still works, so nobody has looked at the server in years.

You don't know who your host is

Or whether they update PHP for you, or if that's on you.

You take payments or bookings

Checkout pages, intake forms and customer logins put real customer data on the line.

You're on a VPS or your own server

Nobody patches that for you automatically. Someone has to do it by hand.

Your site was built before 2023

Older sites are the most likely to be stuck on PHP 8.1 or earlier, which got no official update.

How The Free Check Works

Enter your domain

No password, no admin access, no plugin. Just the address people type to find you.

We look from the outside

We read the same public signals any visitor's browser receives, like the server and PHP version your site advertises. We never touch your files.

You get a straight answer

One of three results below, plus what to do next and a ready-to-send message for whoever manages your hosting.

Looks patchedYour site reports a fixed version.

Likely exposedYour site reports an unpatched or unsupported version.

Can't tell from outsideYour server hides its version. We'll tell you the one question to ask your host.

Who's Running Your Check

Joel Yi

Founder & CEO, Deploy AI Bots

Joel is a Computer Science grad and former U.S. Army Cyber Security Officer who held a Top Secret clearance. He's spent his career building technology where mistakes weren't an option.

When a federal advisory says "patch immediately," most business owners don't know where to start, or who to call. This check gives you the answer in plain English so you can act on it today.

U.S. Army Cyber Officer Top Secret Clearance B.S. Computer Science Veteran-Owned

Questions Owners Ask

Is this actually free?

Yes. The check and your results cost nothing. If your site turns out to be exposed and you want us to help fix it, we'll tell you what that involves, and you can decide. No obligation.

Will the check slow down or break my site?

No. It's a passive look from the outside, the same kind of request a normal visitor's browser makes. We don't log in, install anything, or try to attack your site.

Can you say for certain whether I'm safe?

Not from the outside, and nobody honest can. Many servers hide their PHP version, and some hosts apply fixes without changing the version number. When we can't tell, we'll say so, and give you the exact question to ask your host so you get a definite answer.

My host handles updates. Do I still need this?

Many managed hosts do update PHP for you, but plenty of sites are on plans or older servers where that doesn't happen automatically. The check takes 30 seconds and tells you whether the update actually landed.

What if I'm exposed?

You'll get a short, copy-and-paste message to send your host or developer asking them to update to a fixed PHP version. If you don't have anyone to send it to, reply to your results email and we'll help.

Are you with the NSA or the government?

No. Deploy AI Bots is a private, veteran-owned company. We're not affiliated with the NSA, the U.S. Army, or the PHP project. We reference the NSA's public advisory so you can read the source yourself.

Don't wait to find out the hard way.

The fix exists. The only question is whether it's on your server yet. Thirty seconds and a domain name is all it takes to know.

Check My Site Free →

Free · No login · Nothing installed

Deploy AI Bots is not affiliated with or endorsed by the National Security Agency, the U.S. Army, the Department of Defense, or the PHP Group. This free check reviews publicly visible information only. It is not a penetration test or a full security audit, and it cannot guarantee that a website is or is not vulnerable. Always confirm patch status with your hosting provider. This site is not part of, or endorsed by, Facebook, Meta, Google, or YouTube.

Free PHP2Shell check30 seconds · no login

Check My Site