PHP2Shell Site Check

Warns when a site's server reports a PHP version vulnerable to PHP2Shell (CVE-2026-109618/109619). Never sends requests.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical flaws in the PHP interpreter, disclosed on 21 October 2026. These flaws can allow unauthenticated remote code execution on affected PHP deployments. A compromised server can steal what visitors type into it, such as passwords and card numbers, and can serve them malware. Many site owners will be slow to patch. PHP2Shell Site Check tells you when the site you're on looks unpatched: • Red ! badge: the server reports a PHP version older than the fixed releases 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or an end-of-life branch with no fix. • Orange ? badge: the version predates the fix but looks like a Linux distribution build that may have backported it. • PHP badge: PHP is detected but hides its version. • Green ok badge: the reported version includes the fix. On red or orange sites, a one-time warning appears when a password or payment-related field receives focus. The popup shows the evidence from response headers. The extension checks response headers your browser already receives. It never sends requests or probes and makes no network connections of its own. It processes page addresses, response-header evidence and sensitive-field focus only on your device to provide the check. It never reads typed form values or transmits this data to the developer or third parties. Tab evidence stays in browser session memory until the tab closes or the browser exits. Hidden versions and distribution backports mean the result is a hint, not proof. Open source under the MIT license: https://github.com/newtro/php2shell-site-check