---
title: PHP version and software exposure checks in the API, MCP and A2A
description: Checking whether a site is exposed to php2shell, or which outdated software it reveals, meant opening the free tools by hand, so an agent or a script could…
canonical: https://watchfor.io/changelog/2026-10-22-php-exposure-diagnostics
---

[All updates](/changelog#2026-10-22-php-exposure-diagnostics) ✨ New Oct 22, 2026 · v 11.9.9

# PHP version and software exposure checks in the API, MCP and A2A

Checking whether a site is exposed to php2shell, or which outdated software it reveals, meant opening the free tools by hand, so an agent or a script could not do it for you. Both checks are now live diagnostics: php-version-checker and software-exposure-checker run from the probe fleet over REST, MCP and A2A and return the same A+ to F grade as the pages, with the findings that hold it down and the fix for each.

## What changed

- php-version-checker : reads the PHP version a site announces and grades it against php2shell (CVE-2026-109618, CVE-2026-109619), known CVEs, CISA's exploited list and end of life. Aliases php , php-version .

- software-exposure-checker : reads the web server, PHP, CMS and JavaScript library versions a page reveals and grades each against release, end-of-life and CVE data. Aliases exposure , software-exposure .

- Both are passive (ordinary page requests, nothing exploit-like), take a URL or a bare domain, and spend the same per-plan allowance as the free tools in the dashboard Toolbox. Live diagnostics now cover 26 checks.

Details: [live diagnostics](/docs/api/diagnostics#php-version-checker).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-10-22-php-exposure-diagnostics · Site guide: https://watchfor.io/llms.txt