elePWNantpwnelePWNant
$PWN
Warning · PHP2Shell · CVSS 9.2

Most of the web runs PHP.
Two bugs just made it pwnable.

Anyone can run code on an unpatched PHP server. No login needed. Exploits are already public. Is your site one of them?

Try: , ,

Passive: one normal request to the home page. No exploit, nothing stored. Live counts, no site names.

1
Check

Type your site. We read the PHP version it shows to the world, like a browser would.

2
Get a verdict

PWNABLE, PATCHED or UNKNOWN. Unknown is never treated as safe.

3
Fix in one command

Pick your setup (Ubuntu, Docker, cPanel…) and copy the exact command.

elePWNantpwn
elePHPant→elePWNant

elePHPant is PHP's mascot: a little blue elephant every PHP developer knows.

Pwn is hacker slang for taking over a system. Say it like "own", with a P.

elePWNant is PHP's elephant, pwned. Which is what PHP2Shell does to unpatched servers.

Manual › Security › PHP2Shell › is_pwnable

is_pwnable

(PHP2Shell · CVE-2026-109618, CVE-2026-109619) — Find out if anyone on the internet can run code on a PHP server

is_pwnable(string $domain): Verdict

Return Values

PWNABLE
This PHP version is affected by PHP2Shell and the fix is not in it. Anyone on the internet could run code on this server. Update now.
PWNABLE (end of life)
This PHP branch is end-of-life and affected. There is no fixed release for it: move to PHP 8.3 or 8.4.
UNKNOWN
This site runs PHP but hides its version, so we can't tell. Unknown is never safe: check from inside with php -v.
PATCHED
The version shown already includes the PHP2Shell fix. Nice. Keep it updated.
NO PHP SEEN
Nothing in this site's public response points to PHP. That's a good sign, not a guarantee: a backend can still run PHP behind it.

Fix it in one command

Pick where your PHP lives. Target: PHP 8.3.36 (branch 8.3) or newer.

sudo apt update && sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm 2>/dev/null; sudo systemctl restart apache2 nginx 2>/dev/null

Packages from the ondrej/sury repos get the numbered release. Distro packages may backport the fix instead.

Note
After updating, check again (or run php -v) to confirm the new version is live.

Changelog

BranchDescription
8.5Fixed in 8.5.12. Earlier 8.5.x releases are affected.
8.4Fixed in 8.4.27. Earlier 8.4.x releases are affected.
8.3Fixed in 8.3.36. Earlier 8.3.x releases are affected.
8.2Fixed in 8.2.35. Earlier 8.2.x releases are affected.
≤ 8.1End of life and affected. No fixed release: upgrade to 8.3 or 8.4.

Notes

Caution
Debian, Ubuntu and RHEL-family packages sometimes ship the fix without changing the version number. If your PHP comes from your distro, also check its security tracker.
Note
UNKNOWN is never treated as safe. Headers can be hidden or faked, so a site that shows no version may still be affected.
Note
This tool is passive: one GET request to the home page, no exploit, no login attempts. We don't publish lists of affected sites.
Note
elePWNant is an independent project, not affiliated with the PHP Group. $PWN is the community coin around it: it doesn't change what the checker does, and it's not an investment.

See Also