Free exposure check

Check your PHP servers for php2shell

Enter your domain. We find its PHP endpoints, check each one against the CVE-2026-109618 fixes, and email you the results.

Must match your email domain.

Nothing runs until you click the link we email you. Results go only to that address.

What the check does

  1. You confirm

    We email a link to the address you enter. Nothing touches your domain until you click it.

  2. Recon, a few minutes

    ThreatWell Command, ADCL's attack-surface platform, maps hosts under your domain: DNS and certificate lookups, a scan of common ports, web server fingerprinting, and requests for common paths. It also makes read-only checks of HTTP headers (CORS, caching, API schemas) and sends one short, capped burst to read rate-limit headers.

  3. PHP check, one request each

    For each web server where recon found PHP, we send one GET request and read the PHP version it reports, then compare it with the releases that fix CVE-2026-109618.

  4. Results

    A summary by email and per-endpoint details online. The version comes from what the server reports, so confirm on the server before closing anything.

What it never does

  • Send exploit or crash-test traffic, or test whether the vulnerability can be triggered
  • Log in, submit forms, or send requests that change data
  • Copy content from your sites

How to recognize our traffic

PHP check requests carry the user agent p2s-detect/1.1-js (+https://check.adcl.dev/; soc@adcl.io), From: soc@adcl.io, and X-ADCL-Check with your check ID. Recon requests come from ThreatWell Command. Questions about either: soc@adcl.io.

What we keep

Your results and email address are deleted 7 days after the check. The recon data is archived in ADCL's ThreatWell Command. We email you about ADCL only if you tick the box.

One CVE is a snapshot

This check answers one question about one CVE, today. ThreatWell Command maps your external attack surface continuously and checks it against every new CVE as it is disclosed.