Is A Website Still Open To PHP2Shell? Check Its PHP Version In One Click
PHP Version Check is a free Chrome extension. Click the icon on any website and it shows the PHP version the server reports, with a clear verdict: fixed, affected, or can't tell from outside. Switch on the automatic check and every page you open gets a coloured badge.
This page runs without PHP. Install the extension and click its icon right here: it shows No sign of PHP. The IM Dominator hub is built on a different stack, so PHP2Shell does not touch it.
Join The IM Dominator Community (Free)
Get new free tools like this one as soon as they're released, plus AI and automation workflows for your online business, and direct access to me and other marketers who build the same way.
Enter your email and get free updates + new tools like this one:
Already a member? Go straight to the community →
What Is PHP2Shell?
PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026. Both let an attacker run code on a web server with no login. Every PHP installation that serves web requests is affected until it runs a fixed release.
php -v or phpinfo(), update to a fixed release, and ask your host whether their build carries the backport. PHP's own advisory also recommends session.upload_progress.enabled=0 until the next bugfix release.How To Install PHP Version Check
It installs as an unpacked Chrome extension and takes about a minute:
- Download & unzipDownload the ZIP above and unzip it into a folder you keep. Chrome loads the extension from there.
- Open the extensions pageType
chrome://extensionsinto the address bar and press Enter. - Turn on Developer modeFlip the "Developer mode" switch in the top-right corner.
- Load unpackedClick "Load unpacked" and select the unzipped
php-version-checkfolder. - Pin it & click itClick the puzzle piece, pin PHP Version Check to your toolbar and click it on any website.
How To Read The Result
The popup and the badge use four colours:
Red — affected
The server reports a version older than the fix, or an end-of-life branch (8.1 and older). The site owner should update.
Orange — can't tell from outside
A Ubuntu or Debian build, a hidden patch level or a pre-release. Distributions often backport fixes and keep the old number, so only the host can confirm.
Grey "PHP" — version hidden
The site runs PHP but hides the version. The verdict stays open.
Green — fixed
8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer: the release contains the PHP2Shell fix.
Three Extras In The Settings
All three are optional and off or harmless by default.
Block active content
Stops scripts, frames, plugins and websockets on affected sites (or also on unclear ones) until they report a fixed version. A hacked server can serve harmful scripts to its visitors; this keeps them off your browser. One click on "Allow on this site" lifts it.
Ready for the next PHP bug
The fix list is editable: enter the fixed releases of the next advisory, and every check uses them right away. "Reset to PHP2Shell" brings back the built-in list.
Node.js hint
Node.js had its own security release on 21 Oct 2026 (fixed in 22.23.4, 24.22.1 and 26.12.1). When a site runs on Express, Next.js or another Node stack, the popup shows what the server reveals and which releases are fixed.
FAQ
Is PHP Version Check really free?
Yes. Free download, no sign-up, no API key, no limits.
Does a green result mean a website is safe?
Green means the server reports a PHP release that contains the PHP2Shell fix. It says nothing about other security issues on that site.
Why do some sites show no version?
Many servers hide their PHP version, and a CDN or proxy can remove the header. You then see "PHP detected, version hidden" or "No sign of PHP". A missing version is no proof that a site is safe.
Does the extension scan or attack websites?
No. It reads the response headers of the page you are on. The click check repeats one request to the same address; the automatic check reads the headers of the page load itself. It never requests other paths and never tests for the vulnerability.
Does blocking break websites?
On blocked sites scripts don't run, so menus, logins or checkouts can stop working. That's the point on an affected site. Allow a site you trust with one click, and the block ends by itself once the site reports a fixed PHP version.
Which browsers does it work in?
Google Chrome and Chromium-based browsers that let you load unpacked extensions, such as Brave and Edge.