PHPeek — Instant PHP2Shell Check

Peek before you trust. One glance tells you if a site runs a PHP version exposed to PHP2Shell. Zero data collected.

Peek before you trust. Millions of WordPress, Magento, Drupal and Joomla sites run on PHP. PHP2Shell (CVE-2026-109618 / CVE-2026-109619) showed that one request can take over a server running unpatched PHP — no login, no plugin bug needed. You can't see which PHP a site runs. PHPeek can. ONE GLANCE, THREE ANSWERS 🔴 "!" — Likely exposed. The site shows a PHP version older than the fix, or PHP 8.1 and below (never patched). 🟢 "OK" — All good. The PHP version on display is patched. 🟠 "?" — Runs PHP, keeps its version secret. WordPress, Magento or PHP spotted, version hidden. Click the icon for the details. 100% PASSIVE. ZERO DATA. • No requests — never contacts the sites you visit. There's no PHPeek server to phone home to. • No tracking — results stay in your browser and vanish when you close the tab. • No poking — doesn't test or exploit anything. It just reads headers. • Nothing to hide — open source, under 200 lines of JavaScript. THE FINE PRINT • Most well-run sites hide their PHP version, so you'll see "?" a lot. That's good security. • "!" is a strong hint, not proof: some Linux distros patch without bumping the version number. • PHPeek can't tell if a site was already hacked. Run a PHP site? Patched releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35.