<?php
/**
 * Patchferry web check — shows the PHP version your WEBSITE actually runs and its
 * PHP2Shell (CVE-2026-109618 / CVE-2026-109619) status. Read-only; sends nothing anywhere.
 *
 * 1. Upload this file to your site's public folder.
 * 2. Open https://your-site/patchferry-check.php once.
 * 3. Delete the file. It also stops working by itself one hour after upload.
 *
 * Facts as of 23 Oct 2026. https://patchferry.pages.dev
 */

header('Content-Type: text/plain; charset=utf-8');
header('X-Robots-Tag: noindex, nofollow');
header('Cache-Control: no-store');

// Refuse to run if the file has been left on the server for more than an hour.
if (@filemtime(__FILE__) < time() - 3600) {
    http_response_code(410);
    echo "This check file has expired. Please delete patchferry-check.php from your server.\n";
    exit;
}

$fixed = ['8.5' => 12, '8.4' => 27, '8.3' => 36, '8.2' => 35];
$ends = [
    '8.6' => '2030-12-31', '8.5' => '2029-12-31', '8.4' => '2028-12-31', '8.3' => '2027-12-31',
    '8.2' => '2026-12-31', '8.1' => 'ended 2025-12-31', '8.0' => 'ended 2023-11-26', '7.4' => 'ended 2022-11-28',
];

$version = PHP_VERSION;
$branch = PHP_MAJOR_VERSION . '.' . PHP_MINOR_VERSION;
$patch = PHP_RELEASE_VERSION;
$suffix = PHP_EXTRA_VERSION;

if ($branch === '8.6') {
    $status = $suffix !== '' && preg_match('/rc|beta|alpha|dev/i', $suffix)
        ? 'PRE-RELEASE: not meant for production'
        : 'OK: 8.6 includes the fixes';
} elseif (isset($fixed[$branch])) {
    if ($patch >= $fixed[$branch]) {
        $status = $branch === '8.2'
            ? 'PATCHED, but PHP 8.2 security support ends 2026-12-31. Plan an upgrade.'
            : 'PATCHED';
    } elseif ($suffix !== '') {
        $status = "CHECK VENDOR: this is a vendor build ($suffix). Upstream fixed it in $branch.{$fixed[$branch]}; check your OS or host's security advisory.";
    } else {
        $status = "VULNERABLE: update to $branch.{$fixed[$branch]} or later, then restart PHP.";
    }
} elseif (in_array($branch, ['7.4', '8.0', '8.1'], true)) {
    $status = 'END OF LIFE: likely vulnerable unless your host backported the fix. Upgrade to PHP 8.3 or 8.4.';
} else {
    $status = 'VULNERABLE: no fix exists for this version. Upgrade required.';
}

$uploadProgress = ini_get('session.upload_progress.enabled') ? 'On' : 'Off';

echo "Patchferry web check\n";
echo "====================\n";
echo "PHP version:        $version\n";
echo "Server API:         " . PHP_SAPI . "\n";
echo "Security support:   " . ($ends[$branch] ?? 'ended') . "\n";
echo "PHP2Shell status:   $status\n";
echo "session.upload_progress.enabled: $uploadProgress (turning it Off is only a partial stopgap, not a fix)\n";
echo "\nDelete this file now. Send the lines above to https://patchferry.pages.dev/#contact for a free assessment.\n";