Piolink said on Thursday it released an emergency “php2shell” check page on its official website to help users determine whether they are exposed to critical PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619), widely used in building websites.

The company said anyone who needs to check can do so by entering only a homepage address, even if they do not know which PHP version their website uses.

The page identifies the PHP version used by the server and reports one of three outcomes: “vulnerable,” “patched” or “unable to verify.” Users can immediately view action guidance, including how to update and temporary response measures, based on the result. The check verifies only the server’s response information in the same way as a normal connection and does not send requests that actually attack the vulnerability.

The site is scheduled to be available for one week.

Piolink CEO Young-chul Cho (조영철) said, “If security has so far focused on cause analysis after an incident, it now needs to stay one step ahead by continuously checking the status of external exposure and discovering risks in advance.” He added, “This check page provides not only the check results but also how to identify abnormal signs. It also allows users to confirm PHP version information that corresponds to the vulnerability and response methods. As attackers speed up with AI and automation, defenses must also strengthen security by using AI-based threat management tools such as BlueHunter.”