Public New free tool: see which websites are still open to PHP2Shell (and block them)

On 21 October, PHP published fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two critical flaws that let attackers run code on a web server with no login. Many sites will stay unpatched for a while, and a hacked server can serve its visitors harmful scripts, fake login forms or malware.

So I built PHP Version Check, a free Chrome extension that protects you while you browse:

• 🟢🔴 A badge on every site you open: green = patched, red = still open to PHP2Shell, orange = can't tell from outside
• 🛡️ Block scripts on affected sites until they're patched, with one click to allow a site you trust
• 🔍 One-click check with the raw server header, so you see why
• 🔁 Editable fix list, ready for the next PHP bug
• 🟩 Node.js hint for the 21 October Node.js security release
• ➕ Side effect: check your own sites the same way

👉 Free download and install steps: https://imdominator.com/f/php-version-check

▶️ 3-minute walkthrough: https://www.youtube.com/watch?v=i7lY6NmJAVQ

Fun fact: this hub runs without PHP. Click the extension here and it says "No sign of PHP" 😄

Please share it with anyone who spends their day in the browser. And tell me in the comments: how many red badges did you hit?