This static page sends the response header X-Powered-By: PHP/8.1.2-1ubuntu2.20, so the Securin PHP2Shell check reports it as Likely vulnerable.
No PHP runs here, and there is nothing to exploit. It exists only to demonstrate the checker.
Provided by Securin.