Observed arrival · 2026-10-25
Shellproof’s six-check PHP2Shell toolkit
Shellproof offers browser-based and CLI checks for PHP exposure, configuration risks, vulnerable dependencies, suspicious code, and exposed secrets.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- PHP developers and server administrators
- Worth noticing
- The Composer audit checks composer.lock against Packagist security advisories; the page says secrets are masked before display.
Field notes
The version checker accepts php -v output, phpinfo text, or an X-Powered-By header, then labels the version patched, outdated, or end-of-life. Separate checks cover PHP configuration and code patterns, while the dependency audit uses the Packagist security-advisories API. The page also lists a Content-Security-Policy builder with output for nginx, Apache, Caddy, Cloudflare, and _headers.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue