Free PHP Vulnerability Scanner
Enter a site and get a verdict in seconds — the same scanner that runs on our home page, free for every site, no sign-up.
The scan reads only what your site discloses publicly — passive fingerprinting plus limited, read-only checks of a few well-known paths (such as an exposed phpinfo page); we never run exploit probes against a site. For a definitive verdict we run a read-only deep check on your server, then patch in one click and hand you a work report with a SHA-256 integrity hash.
What it checks
- php2shell — CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2): the disclosed PHP version is compared with the fixed releases — 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- How the version is read — response headers, generator tags and an exposed phpinfo page: only what the site already discloses publicly.
- Limited read-only path checks — a few well-known paths, such as an exposed phpinfo page, requested like any other visitor's traffic. No exploit probes, ever — nothing the scanner sends attempts to trigger a vulnerability.
- SSRF-hardened — the scanner refuses loopback, private and link-local targets (including cloud metadata endpoints), pins the validated IP and re-validates every redirect.
What the verdicts mean
- VULNERABLE — the disclosed PHP is below the fixed release for its branch.
- POSSIBLY VULNERABLE — below the floor, but a distribution build: distros backport fixes without changing the version, so treat this as a check signal, not proof.
- PATCHED — the disclosed version is at or above the fixed release.
- END OF LIFE — a branch older than 8.2: no upstream fix exists, so the branch itself must be upgraded.
- VERSION HIDDEN — the site does not disclose its PHP version, so no external tool can judge it. The scanner says so instead of guessing; the certain answer is the read-only deep check on the server, after you prove ownership.
- NOT ASSESSED — the target could not be reached or assessed on this run.
Next step after a verdict: the patch service fixes it, or a monitor plan keeps watching it — pre-patch snapshots are kept 72 hours on the Patch tier and for an extended window with rollback, so a verdict is never the end of the story.
Open source
The scanner is phpatchscan — the exact code that runs the scan on this site, MIT-licensed: github.com/PHPatch/phpatchscan, or download the zip and run it from your own terminal. The patching engine is not open source. See how the scanners compare: PHP vulnerability scanners compared.
Our products
- Free Vulnerability Scanner — Check a site now — no sign-up, no exploit probes
- PHP Patch Service — One-time verified patch — $49 / $99 with rollback
- Patch & Monitor Plans — Scheduled re-scans + change alerts — $299/$399 a year
- Automated Pentest — Canary-verified assessment + virtual-patch pack — $99
Security & disclosure · Terms · Privacy · DPA · About · Open-source scanner on GitHub
Threats — PHP vulnerability advisories · Compare PHP vulnerability scanners · Automated Pentest
Superstar Telecom LLC, a New York technology company that operates multiple websites and products, Found on 08/2014.
Your data stays yours: backups are retained only for the window above and deleted on request.
Not affiliated with the PHP Group. PHP is a trademark of the PHP Group.