v1.2.0

PHPeek now protects people who don't own any crypto too. A hacked store doesn't just serve wallet drainers: it copies cards at checkout and leaks passwords.

💳 Card Guard

• Anti-skimmer: type your card number and PHPeek recognises it if a hidden script tries to send it anywhere other than the store or a payment provider (Stripe, PayPal, Adyen…). The request fails and you're told where it was going.
• Clicked Pay and the form sends your card to an unknown site? PHPeek asks first.
• On 🔴 exposed stores: a heads-up at the card field. Pay with PayPal / Apple Pay / Google Pay instead.

🔑 Password Guard

On 🔴 exposed sites, a heads-up before you type your password: PHP2Shell can leak server memory. Unique password + 2FA.

🔎 Check any site

Type an address in the popup and check a store before you even open it. This is the only time PHPeek contacts a site: one page, no cookies.

Honest limits

Skimmers that encrypt the card, send it from a later page, or post it back to the hacked store's own server can get through. See the README's threat model.

Full list in CHANGELOG.md. Tested in real Chromium against skimmer techniques, independently reviewed.

SHA-256

• phpeek-chrome-1.2.0.zip: fe6d30a5b04a0514b515371026b6c286ed152b5cb62dbaf91b640eb6e6e8360d
• phpeek-firefox-1.2.0.zip: e1c297de68903978bfa094693ebf19ea1c1863df3408f7a58732a92c60691864

PHPeek 1.1.0 — Wallet Guard

👀 v1.1: PHPeek now guards you on every site, not just PHP2Shell-exposed ones.

A hacked site doesn't attack you directly. It serves you a fake wallet-restore form, a drainer signature, or a "verify you're human" clipboard trick. v1.1 watches for exactly that:

• 🛡️ Seed Shield: paste or type a seed phrase into a website → cleared + warned
• ✍️ Wallet signature check: unlimited approvals, setApprovalForAll, Permit/Permit2, marketplace orders, delegations and blind signing are paused and explained before your wallet opens
• 📋 Clipboard Guard: ClickFix commands silently copied by a page are swapped for a harmless warning
• 📨 Tell the site owner button on exposed sites; popup no longer shows exact PHP versions
• Warnings open in a PHPeek window the page can't hide or fake

Hardened after an independent review: all decisions run in the extension's isolated world; tested against hostile pages that forge messages or override JavaScript built-ins (38 real-browser attack tests). Full details and honest limits in the README and CHANGELOG.

Tested with real MetaMask and Phantom in Chrome (unlimited approve, Permit, harmless signature pass-through, Seed Shield, ClickFix). Store review in progress. Still 100% local, zero data. A safety net, not a shield.

Install manually

Chrome / Brave / Edge: download phpeek-chrome.zip, unzip, chrome://extensions → Developer mode → Load unpacked.

PHPeek 1.0.0

👀 Peek before you trust. First release.

PHPeek badges its icon when the site you're on advertises a PHP version exposed to PHP2Shell (CVE-2026-109618 / CVE-2026-109619):

• 🔴 ! Likely exposed (older than the fix, or PHP 8.1 and below)
• 🟢 OK Patched
• 🟠 ? Runs PHP, version hidden

100% passive: no requests, no tracking, no data.

Install manually

• Chrome / Brave / Edge / Opera: download phpeek-chrome.zip, unzip, open chrome://extensions, turn on Developer mode, click Load unpacked and pick the folder.
• Firefox: store listing coming soon. phpeek-firefox.zip is the package submitted to Mozilla.

Store links coming soon.