PHP2Shell: The Critical Bug Hiding in Plain Sight — and the Free Tool That Finds It in Seconds

A serious security flaw was recently found in PHP, the software that runs a huge share of websites — including most WordPress and Drupal sites, and countless custom business sites. It's being called PHP2Shell. The scary part isn't just how bad it is. It's how easy it is for anyone — including someone who's never visited your site — to find out if you're exposed.

Hackers with an off the shelf cloud server can scan thousands of domains per hour looking for PHP gaps. You want to confirm if your exposed now before a hacker does (see how to do this below).

Why PHP2Shell Is Dangerous

PHP2Shell lets an attacker take over a server completely — no password, no account, no prior access needed. They just need to be able to reach your website. Once in, they can run whatever code they want on your server. That's not a leaked file or a settings mistake. That's someone else fully in control of your system.

This isn't a theoretical risk, either — attackers are already using it. And it affects a wide range of PHP versions, so any site that hasn't specifically upgraded in response to this disclosure is a likely candidate, no matter what platform it's built on.

Why You Need to Fix It Fast: It's Easy to Find

Here's what makes this urgent. Checking whether a website runs a vulnerable version of PHP doesn't take any hacking — it's often sitting right there in plain sight. Many servers reveal their PHP version in ordinary page data, the same way they tell your browser how to display the page.

That means two things. Checking your own site takes seconds, with no technical skill required. But it also means attackers can check thousands of sites the same way, automatically, using tools that scan the entire internet for exactly this kind of weakness. If your site is vulnerable, you're not hypothetically at risk — you're already visible to anyone looking. The longer a vulnerable version stays live, the longer you're sitting in a crowd of easy targets.

What I Found When I Checked 650 Companies

To see how real this risk actually is, I scanned 650 company domains for PHP2Shell. Eight came back vulnerable.

I tried to warn all eight. Four of them had no way to even report a security issue — no security contact, no disclosure page, nothing. Of the remaining four, only one replied at all — and they told me they didn't use PHP. Their own website said otherwise, and the scan confirmed it: they were vulnerable.

That's the real-world state of this: more than half of the vulnerable companies I found had no process for someone to warn them, and the one company that did respond didn't even know what was running their own site.

Check Your Own Exposure — Free, in 30 Seconds

KandiCare built a free tool for exactly this: the PHP2Shell & jQuery Vulnerability Scanner.

It checks two things:

1. PHP2Shell — whether your site is running a vulnerable version of PHP.
2. An old jQuery bug — a separate, well-known flaw in an older web script called jQuery, still actively exploited today, usually because an old version quietly lingers on a site no one's touched in years.

No account, no signup, no cost. Enter a domain, get an answer in seconds. If something's wrong, it tells you exactly what to fix.

Don't Just Check Your Own Site

Your risk isn't limited to your own domain. Most businesses rely on outside vendors and partners — payment processors, support platforms, booking systems — and a vulnerability on any one of them can become your problem too.

The tool lets you check up to 5 domains at once, separated by commas:

yourbusiness.com, vendor.com, partner.com

yourbusiness.com, vendor.com, partner.com

Check your own site alongside the vendors and partners your customers interact with through you — same 30 seconds, whether it's one domain or five.

Want a Deeper Check?

This tool is intentionally narrow — just these two specific bugs, for a fast answer. For a full security checkup, KandiCare also offers a free Domain Security Scan covering 40+ checks, including these two, plus SSL, email security, DNS, and more.

Start with the fast scan. If anything looks off, run the full one.