A major PHP vulnerability is live. Check if your website is exposed for free, in 30 seconds.

A pair of critical PHP flaws (PHP2Shell) are being scrambled on across the web right now, A major PHP vulnerability is live. Check if your website is exposed for free, in 30 seconds.I've written up what they are and why they matter separately. The practical question for most site owners is simpler: is my site exposed? So we built a free tool — phpexposurecheck.com, that answers exactly that, in about 30 seconds, without scanning or touching your server. Fixing your PHP vulnerability has never been easier.

What the free PHP Vulnerability checker does

You enter your website address. In about 30 seconds you get a plain-English read on whether your site looks exposed to PHP2Shell. It's free, and there's no sign-up to run a check.

The important part: the check is passive. It only reads information your site already makes public — the same signals any visitor's browser can see. It does not scan your site, crawl it, probe it, or send it any attack traffic. Nothing we do touches your server. So you can check your own site, or a supplier's, without permission concerns and without setting off anyone's security alarms.

What your result actually means

Passive checking is honest but limited, so the result is deliberately plain about what it can and can't tell you:

•         Flagged / vulnerable — the site is publicly showing a PHP version that falls in the vulnerable range. Worth acting on now.

•         Needs verification — the site shows signs of PHP but doesn't publicly reveal its version. This is not a clean bill of health and it's not an accusation; it means the only way to know is to check from the inside. In practice this is the most common answer, because well-configured sites (anything behind Cloudflare, for example) deliberately hide their version.

•         Clean — nothing publicly visible suggests exposure. Still not a guarantee: passive checking can only see what's public.

Two things worth being blunt about. A flag is a prompt to check, not proof of a breach. And "we couldn't confirm it from the outside" never means "you're safe" — it means someone needs to look properly. The tool is a fast first filter, not a penetration test.

If your site is flagged

The fix is to get PHP onto a patched release for your version line. These are the safe versions:

PHP line	Patched version	Notes
8.5	8.5.12	Upgrade to this or later
8.4	8.4.27	Upgrade to this or later
8.3	8.3.36	Upgrade to this or later
8.2	8.2.35	Upgrade to this or later
8.1 and older	—	End of life, no official fix — upgrade the version line

If you manage your own hosting, your host or platform may have already patched — confirm the running version rather than assuming. If you're on 8.1 or earlier, there is no patch coming; you need to move to a supported line, which is a bigger job worth starting now.

If the tool says needs verification, the next step is to confirm the version from the inside — something your developer, host, or a security provider can do quickly. If you'd rather not chase it yourself, that's what we do.

Check your site

It takes about 30 seconds and costs nothing: phpexposurecheck.com. Check your own site, and the suppliers whose systems touch your data. If anything comes back flagged — or you just want someone to confirm it properly — we're happy to help.

The tool is free from Global Tech Partners (GTP Cyber).