Whether your site runs a version of PHP affected by CVE-2026-109618 and CVE-2026-109619 — two critical core-PHP vulnerabilities that can lead to unauthenticated remote code execution (RCE) & memory disclosure.

It reads the PHP version your server already discloses (response headers, an exposed phpinfo() page, or the runtime itself) and compares it to the patched releases. It does not exploit the flaw or send any malicious traffic.

Vulnerable — a PHP version below the patched release was detected.
Vulnerable (End-of-Life) — PHP 8.1 or earlier, which is affected and will not receive a fix; migrate to a supported version.
Patched — the detected version already contains the fix.
Version could not be determined — the scanner couldn’t read a PHP version (see next question).

If you’re behind a CDN/WAF like Cloudflare, or you hide your version (expose_php = Off), it isn’t visible externally — so we report that honestly instead of guessing. Hiding it is good practice, but it’s not a fix.

Yes. We only collect the target URL and email address to perform the scan and deliver results. Scan data and submitted email address are not shared, sold, or used for marketing. Information is retained only for operational and security purposes and handled in accordance with industry-standard data protection practices.

Upgrade to the patched release for your branch (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), then redeploy and restart your PHP workers — a package upgrade alone won’t update running workers.

Yes. If your application is vulnerable or you want further assurance, we can assist with remediation guidance, patch validation, and in-depth penetration testing. Our team can also perform broader assessments covering web applications, APIs, infrastructure, and AI deployments to ensure the vulnerability is fully addressed and no additional risks remain.