Paiolink opens emergency PHP2Shell vulnerability check page
The check page takes a website URL and reports whether the site looks vulnerable, patched, or unconfirmed, based on its observed PHP version.
South Korean security company Paiolink said on October 23, 2026, that it has opened an emergency check page for the PHP2Shell vulnerability on its official website, according to dailysecu.com. Visitors can enter a website address and see whether the site may be exposed to the flaw, along with recommended security measures.
The page returns one of three outcomes — vulnerable, patched, or unable to confirm — based on PHP version information observed from the server. Paiolink said the tool sends only ordinary web requests and does not exploit the vulnerability itself.
The company will keep the page publicly available for one week. It is accompanied by a self-checklist and a vulnerability analysis report drawn from Paiolink's cyber threat intelligence (CTI).
Disclosure and warnings
The tool follows the disclosure of two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, by the PHP development organization on October 21, 2026. The flaws allow unauthenticated remote code execution, and security updates were released the same day.
Both were rated 9.2 on the CVSS scale. KISA issued a security notice that day recommending updates to the latest version, and CERT-EU warned that exploit code has begun spreading and is likely being used in real attacks.
Quick answers
What is the PHP2Shell check page?
An emergency page on Paiolink's official website where users enter a URL to see whether a site may be exposed to the PHP2Shell vulnerability, along with recommended security measures.
How long will the check page be available?
Paiolink says the page will be publicly available for one week.
Does the check page exploit the vulnerability?
No. Paiolink says it sends only ordinary web requests and does not exploit the flaw.