You installed XAMPP for practice and left it there
It checks in seconds whether an old PHP is still on your PC. It does not run php.exe; it only reads the file's version information.
PHP GUARD
Find old PHP on your PC
and mitigate it, free.
NEXORIA looks for PHP installed with XAMPP, Laragon, WAMP and similar tools, and checks for free whether it is a version affected by PHP2Shell, the critical flaw disclosed in October 2026. If it finds one, you can apply a temporary mitigation with one click, also free. The complete fix is updating to a patched version.
We don't stop your AI. We only brake when something is risky.
01 / WHEN
SCENES
When it protects you.
You're trying out WordPress on your own PC
If the version is vulnerable, it shows Danger and lists the fixed versions (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35). PHP 8.1 and earlier will not get a fix, so it recommends moving to a newer version.
You can't update right away
The free temporary mitigation sets session.upload_progress.enabled to Off in php.ini (one of the mitigations listed by the PHP project; on 8.5 it also turns fatal_error_backtraces Off). It copies the original file before changing anything, so you can always undo it.
A web server is running right now
It also finds running PHP and Apache processes, and if they can be reached from other devices it tells you to deal with it soon.
02 / SCREEN
03 / FLOW
WHAT HAPPENS
What happens
when you use it.
- 1Check risky developer softwareFind PHP on your PC
- 2Check the versionTell vulnerable and too-old versions apart
- 3Temporary mitigation (free)Copy the config file, then turn off only specific settings
- 4Update to a fixed versionThis is the complete fix (per the PHP project)
04 / HOW
MECHANISM
How it works.
Where it looks
The install locations of C:\xampp, C:\php, Laragon, WAMP, MAMP, Herd, Local, Scoop, winget and Chocolatey; XAMPP and similar folders at the root of each drive; IIS settings; php.exe on your PATH; and PHP or Apache processes running right now.
How it decides
It reads the version information of the php.exe file and compares it with the PHP project's fixed versions (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35). It does not run php.exe.
What the mitigation changes
It sets session.upload_progress.enabled to Off in php.ini (for WAMP, also in Apache's config file). Afterwards the status reads "Temporarily mitigated — update still needed." The PHP project says there is no complete mitigation and that updating is the only safe option, so you still need to update. It takes effect after you restart your web server (Apache, etc.).
05 / DATA
PRIVACY
What goes out,
what stays in.
What is sent out
- Nothing. Both the check and the mitigation happen only on this PC
What is never sent
- PHP locations, versions and settings
- Your site's content and files
06 / LIMITS
HONEST
What it can do,
and what it can't.
What it can do
- Find PHP on your PC and check its version (free)
- Mark vulnerable versions and old versions with no fix as Danger
- Apply a temporary php.ini mitigation with one click (free)
- Undo the mitigation
What it can't do / limits
- It does not update PHP itself (install the new version from its distributor)
- It cannot check PHP on rental servers or in the cloud (see your hosting provider's guidance)
- This mitigation does not block every attack
07 / PRICE
PRICING
Free for 10 days from sign-up.
After that, Pro is ¥980/month (1 PC) and Small Team is ¥2,980/month (up to 5 PCs). Your decision history and settings stay available even after your plan ends.
08 / FAQ
QUESTIONS
Frequently asked questions
Should ordinary users install it too?+
If you don't run PHP on your PC, this issue doesn't affect you. It mainly affects servers. After big news like this, also watch out for fake emails that try to take advantage of it.
Is it really free?+
Finding and mitigating PHP2Shell is part of NEXORIA's free features.
Am I safe once the mitigation is applied?+
No. The mitigation only closes off specific attack paths. Be sure to update to a fixed version.
DOWNLOAD
Start by installing the Windows version.
The first 10 days from sign-up are free. You can check the installer's SHA-256 (NX2026.10.22.v37 / approx. 61.7 MB) in the download section.