PHP vulnerability check
Check a website for the new PHP vulnerability.
Enter your work email. In about ten seconds we’ll compare the PHP version the website shows with the fix for CVE-2026-109618 and CVE-2026-109619, and answer that first. The rest of the free outside-in scan follows it.
Enter your work email to get every finding, on this page and in your inbox.
We’ll send the results to that address, and we may follow up about Tenant Strike. Unsubscribe in one click from anything we send. A domain on its own works too, and shows the first two findings.
No agents · No credentials · Nothing to install
Scan domains you own or administer. By running a scan you accept our Terms and Privacy Policy.
The scan reads published records and the domain’s own public website — mail authentication (SPF, DKIM, DMARC), MTA-STS, domain registration and transfer locks, DNSSEC and CAA, certificate transparency logs, publicly indexed hosts and ports, files like security.txt, and the software and browser protections the home page shows. A WordPress site’s plugins are looked up in WordPress.org’s public directory. No port scanning, no sign-in attempts, nothing private.
This is the outside view only. Most of what goes wrong in a small business is inside Microsoft 365 — MFA gaps, forgotten admins, guest access, Conditional Access. The full scan connects read-only in about five minutes and runs 100+ checks across Microsoft 365 and Azure.