php2shell exposure check

Two PHP flaws disclosed on Oct 21, 2026 (CVSS 9.2) allow remote code execution without authentication. This tool makes one normal request to a site's homepage, reads what it publicly reports, and gives you an evidence report for whether it looks affected.

Affected

PHP 8.1 and older; unpatched 8.2–8.5

Fixed in

8.2.35 · 8.3.36 · 8.4.27 · 8.5.12

Check type

Passive, headers + HTML only