Free security tool
Which PHP branch are you actually on?
Enter a website address. We read what the server advertises, identify the PHP branch, and tell you where it sits against the upstream support calendar, including the php2shell fix release for that branch. It will not claim to know whether a distro backport has been applied, because nothing outside the host can know that.
How it works
Four steps, and one of them is not ours.
The last step happens on your server, because that is the only place the question can actually be answered.
Enter the site address
Type the domain, with or without https://. We request that one page and read the response headers.
Read the branch, not the verdict
We report which PHP branch the server advertises and where that sits against the upstream support calendar. We do not claim to know whether a backported fix is installed, because nothing outside the host can know that.
Get the remediation steps
The steps are specific to your branch: the php2shell fix release that applies, how to confirm it from the vendor package version, and which mitigations make the problem worse.
Confirm on the host
Query your package manager for the installed PHP package and read its changelog. The vendor version is the string that settles it.
The bigger picture
Patching is this week. The branch you are on is this year.
php2shell is urgent and it is not a plan. The plan is knowing which branch each application runs, what the upgrade path costs, and which systems are old enough that upgrading and replatforming have converged.
Frequently asked questions
- Most servers advertise it in the X-Powered-By or Server response header, which is what this tool reads. Many hide it, which is good practice and means an external check cannot tell you the version. In that case the only reliable answer comes from the host itself, by querying the installed package.
- No, and treat any tool that claims otherwise with suspicion. Linux distributions backport security fixes without changing the version number, so a patched and an unpatched build of the same version report an identical string. This tool tells you which branch you are on, whether that branch is still supported upstream, and what to check on the host to settle the question.
- It means upstream has stopped shipping security fixes for it. It does not automatically mean you are unpatched, because distributions often continue to backport. What it does mean is that you no longer control whether a fix exists: you are depending on a vendor's choice, a paid support tier, or your own team compiling a patch under time pressure.
- 31 December 2026. PHP 8.2 left active support on 31 December 2024 and is in security-fix-only support until the end of 2026. This matters for php2shell because 8.2.35 is one of the fixed releases, so a team patching this week may land on a branch that stops receiving fixes a few weeks later.
- This performs a single ordinary GET request to one page, the same request your browser makes when you visit it, and reads only the response headers. It does not log in, scan ports, or probe for vulnerabilities. It identifies itself honestly in the user agent so it is visible in server logs.
Ready when you are
Know which branch you are on. Then decide.
If the result says end of life, the next question is whether upgrading in place or moving is cheaper. That is a two-week answer, not a two-month project.