Bulk Hosting & PHP-CVE Exposure Auditor
Pricing
from $3.00 / 1,000 domain checkeds
Bulk Hosting & PHP-CVE Exposure Auditor
Passively fingerprint the web stack and PHP version of many domains and flag PHP versions behind the latest security release (incl. the Oct 2026 php2shell CVEs). Read-only, no exploit probing.
Pricing
from $3.00 / 1,000 domain checkeds
Rating
0.0
(0)
Developer
srvScripts
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
a day ago
Last modified
Categories
Share
Audit a whole list of domains for PHP version exposure in one run. For each domain this Actor passively reports:
- PHP version (when the server discloses it) and whether it is behind the latest security release — including the October 2026 "php2shell" CVEs (CVE-2026-109618 / CVE-2026-109619) and CVE-2026-115560 (
session.upload_progressRCE). - Web server / stack — LiteSpeed, nginx, Apache, OpenResty, IIS, Caddy.
- WAF / CDN in front — Cloudflare, Sucuri, Akamai, Fastly, Plesk.
- CMS and version — WordPress (and other
generator-tagged CMSs) when exposed. - A plain verdict: EOL PHP, behind latest security release, current, version not disclosed, or no PHP detected.
Passive and safe — read this
This is a passive auditor. It sends ordinary GET requests to the homepage only, reads the response headers and HTML, and never follows a redirect to a private address. It does not probe the session.upload_progress path, send any exploit payload, attempt a login, or test any vulnerability path. It tells you what version is running and whether it's patched — it does not try to break in.
Use it only on domains you own or manage. Version detection is best-effort: a server can hide or spoof its PHP banner, and sitting behind a WAF can shield an unpatched PHP — so a result is a strong hint to confirm on the server, not a guarantee.
Who it's for
Hosting providers, agencies and MSPs auditing many client sites at once for out-of-date, CVE-exposed PHP — portfolio sweeps, onboarding checks, and "are any of our sites behind on the latest PHP security release?"
Input
Output (one dataset row per domain)
domain, reachable, http_code, verdict, php_detected, php_branch, php_status (patched / unpatched / EOL / undisclosed / unknown), php_latest_secure, php_note, web_server, waf_cdn, cms, cms_version, recent_php_cves, baseline_as_of.
The PHP security baseline
The "latest secure version per branch" table is curated and dated (baseline_as_of). As of 2026-10-24: 8.5 → 8.5.12, 8.4 → 8.4.27, 8.3 → 8.3.36, 8.2 → 8.2.35; PHP 8.1 and older are end-of-life (no fixes). Confirm against php.net for the current release.
Built by srvScripts — server and website tools for hosting professionals. https://srvscripts.com/
