Piolink Opens Public Check for Critical PHP Flaw
The tool reports in seconds whether a server is vulnerable, patched or undetermined, and returns update and workaround steps for each result.
Piolink opened a public "php2shell emergency check" page on its website on October 23, 2026, letting website operators see whether their PHP servers are exposed to the CVE-2026-109618 and CVE-2026-109619 vulnerabilities, according to datanet.co.kr.
Users enter a website address and receive one of three results within seconds: vulnerable, patched or undetermined. The page also displays update instructions and a temporary workaround guide matched to the result.
The check only reads normal server response information and does not send requests that would actually attack the vulnerability, the company said. Servers that hide their version may come back as undetermined.
The page additionally offers a self-checklist and an analysis report based on Piolink's cyber threat intelligence. Piolink said the site will remain public for one week.
Update push after critical rating
On October 21, 2026, the PHP development organization released a security update and disclosed the two vulnerabilities, which allow an attacker to take over a server remotely without logging in and were rated 9.2 out of 10. KISA issued a security notice the same day recommending updates to the latest version, and CERT-EU warned that attack code has begun to spread and is likely already being exploited.
Quick answers
What does the Piolink php2shell check do?
It lets anyone enter a website address and find out which PHP version the server uses, returning a result of vulnerable, patched or undetermined along with update and workaround guidance.
Does the check attack the website?
No. Piolink says the check only reads normal server response information and does not send requests that actually attack the vulnerability.
How long will the check page be available?
Piolink said the site will be public for one week.