Is your domain exposed to PHP2Shell?
Enter a .is domain to see what our scan of public websites on 22 October 2026 found. Nothing is sent to the domain when you look it up here.
What we check
The PHP version each server reports, compared against the releases that fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
What we don't do
No exploit attempts, no probes, no writes. The scan made a few ordinary page requests per site, and looking up a domain here sends nothing to it.
Who runs it
The Syndis offensive security team. If something turns up, a consultant can help you contain it.