PHP exposure scan
Find every exposed PHP server you run
Updating the PHP servers on your asset register is the straightforward part. The exposure scan goes after the rest: every address in your agreed scope swept by your scanner, each PHP finding checked by a consultant, and a ranked list of which systems are still vulnerable and what to fix first.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Read the full PHP2Shell guide.
The real exposure
The PHP nobody is patching
On 21 October 2026 the PHP project fixed two critical flaws, known as PHP2Shell, that allow unauthenticated remote code execution against PHP installations serving web requests. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026.
The servers your team already looks after will be updated first. The exposure sits in PHP that has dropped off every list, which is why the first priority action in the NCSC alert is to identify the systems running PHP across your infrastructure, prioritising those that face the internet, and why it warns against confining that search to outdated versions. In the alert's own words, "Organisations using any version of PHP are affected."
Staging and test copies
A copy of the live site stood up for a redesign or a supplier's testing, still answering on a public address after the project ended, with nobody responsible for updating it.
Old microsites and campaign pages
The event page, the product launch or the regional site an agency built years ago. It still resolves, still runs whichever PHP it launched with, and appears on no current asset list.
Containers built from older images
An application image carries the PHP release it was built with. Updating the host leaves the container exactly as it was until someone rebuilds the image and redeploys it.
Appliances and products that bundle PHP
Some vendor appliances and software packages ship their own copy of PHP to drive a web interface. That copy changes only when the vendor releases an update, never through your own patching routine.
Version numbers that mislead
Many Linux distributions apply fixes inside their own PHP package without adopting the new upstream version number, so a patched server can look out of date. Servers set to hide their version give a version check nothing to read at all.
Where a PHP vulnerability scanner stops
A PHP vulnerability scanner on its own reports the version a server presents, and only for the addresses it has been pointed at. It cannot widen its own scope, and it cannot tell a vendor-patched package from an unpatched one by the number alone. Both gaps close with the work done around the scan, and that work is what this service provides.
PHP facts on this page reviewed 27 October 2026 against the PHP project's security advisory, the NCSC alert and the CISA alert.
How the exposure scan works
PHP vulnerability scanning, run as a managed service
The PHP exposure scan is not a separate product. It is the first assessment cycle of our managed vulnerability scanning service, run on a scanner your organisation holds the licence for, with your PHP exposure as the question that cycle answers first.
Step 1
Scope by address range, not by asset register
On the scoping call and at onboarding we agree in writing which IP ranges, hosts and domains are covered. Your scanner then sweeps every address inside those ranges, so a forgotten server within them is found whether or not anyone remembered it.
Step 2
Internet-facing systems lead
In line with the NCSC's ordering, the outside view comes first. External coverage costs nothing extra wherever your scanner reaches your perimeter, and internal coverage arrives through your scanner's agents or a network appliance.
Step 3
Each PHP finding checked by a consultant
No PHP result reaches your list on a version banner alone. A consultant weighs each one against how that PHP was installed, and where internal scans run with credentials, the installed package is examined directly rather than guessed from a banner.
Step 4
Ranked by actual exposure
Our proprietary risk analysis asks whether a flaw is being exploited, whether the system can be reached and what it is worth to the business. A vulnerable PHP server on a public address, carrying two flaws on CISA's known exploited list, sits at the top of that order.
Step 5
Confirmed criticals reported straight away
A vulnerable internet-facing PHP system is not held back for report day. The moment triage confirms one, we tell your named contact, along with the change that closes it, and the written report catches up afterwards.
Step 6
Tracked until it closes
Every finding carries into the following cycle marked fixed, outstanding or new. Your PHP updates are rechecked as part of the service, and the record shows when each one closed.
Nothing about the cycle changes for PHP; the exposure scan simply points it at the question you arrived with. The how it works page sets out every stage of the service, and the first assessment cycle page covers the baseline in more depth.
What you receive
What the exposure scan hands back
The output is the baseline every engagement opens with, written for the engineer who makes the change and the board that wants to know it was made.
A verified finding list
Every confirmed weakness across the scope, PHP and otherwise, with the affected systems and the evidence for each. Duplicates are merged and false positives taken out before you see it.
A prioritised remediation plan
The order to work in, with specific guidance your IT team or provider can follow: the fixed release a server needs, or the vendor update a bundled product is waiting on.
A summary for directors
A short, plain account of where the estate stands, which a director, an auditor or an insurer can read without opening the technical detail.
The monthly rhythm after it
From the second cycle onwards the same scan, triage and report repeat on your service level's cadence, so the next PHP advisory is picked up at the next scheduled scan rather than at an annual review.
What it costs
Because the exposure scan is the opening cycle of the managed service, it is billed as the first month of whichever service level matches your scanners: Essential at £1,890, Managed at £2,870 or Complex from £3,450, each per month before VAT. Scanner licences remain a matter between you and your vendor, and your figure is agreed in writing on the scoping call before anything starts. Every level and what it includes.
PHP exposure questions
Questions about the PHP exposure scan
Should we wait for the scan before updating PHP?
No. Update every PHP system you already know about now. The PHP project's own advisory says "There are no complete mitigations, updating is the only safe choice."
The exposure scan is for the systems you do not know about, and for confirming that the updates you have already made took effect.
Will the scan find PHP we have never told you about?
Within the agreed scope, yes. The scan covers every address in your confirmed ranges rather than a list of known servers, so a forgotten system inside them turns up.
A site hosted outside those ranges, with a third-party web host for example, is covered only once it is added to the scope and to your written authorisation to scan. That is why the scoping call goes through where each of your domains and sites is hosted.
Does the scan look only for these two PHP flaws?
No. Everything in the agreed scope is assessed in the same cycle, so the PHP findings land in one ranked list next to every other weakness your scanner reports, and you can see how they compare.
Our server reports an older PHP version, but our provider says it is patched. Who is right?
Possibly both. Distribution and host-supplied packages can carry the fix without moving to the new upstream version number, so the number on its own settles nothing.
Before a PHP server is reported to you as vulnerable, a consultant checks the finding against how that PHP was installed, and authenticated internal scans can read the installed package directly.
What if the scan finds PHP 8.1 or older?
The PHP project publishes no updates for PHP 8.1 and older, so the guidance for those systems is a move to a supported branch that carries the fix. CISA's alert goes further, advising that PHP systems running 8.1 or earlier, or that cannot be updated immediately, be taken offline.
PHP 8.2 itself reaches end of life on 31 December 2026, which is worth weighing before you settle on 8.2.35 as the destination.
We do not have a vulnerability scanner. Can we still use this?
Yes. The service runs on a scanner that you license, so if there is none in place yet, we recommend one suited to your estate on the scoping call.
You buy the licence directly from the vendor, we set the scanner up and run it as part of the service, and the tool stays yours if you ever leave.
Will you update PHP for us?
No. We say precisely what needs changing on each system, and the change itself is made by your team or IT provider, who own the systems. The following cycle shows which findings have closed.
What if a PHP server looks as though it has already been attacked?
Scanning shows where the weaknesses are; it is not an investigation into whether anyone has used them.
Where a PHP system could not be updated promptly, the NCSC advises assessing it for evidence of compromise and backdoors. That work belongs to CyPro's incident response team, under its own scope.
What do you need from us to begin?
Four things: someone on your side to own the fix list, a written list of the IP ranges, hosts and domains in scope, signed authorisation to scan them, and access to your scanner.
An external-only scope needs nothing installed on your side, so it is the quickest route to a first result. Internal coverage begins once your agents or appliance are in place.
Start with what you cannot see
Find the PHP your asset register missed
A free 45 minute call with a consultant agrees the ranges and sites to cover, matches your scanners to a published service level and books the first cycle, with the fee confirmed in writing beforehand.