The free public check looks for every class below — passively, one page and a fixed probe list at a time. Nothing is exploited, nothing is changed.

critical

php2shell — CVE-2026-109618 / CVE-2026-109619

Two unauthenticated remote-code-execution bugs in the PHP engine itself (CVSS 9.2). CISA Known Exploited; public PoCs. Any PHP site serving web requests is exposed when the runtime is unpatched.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
critical

End-of-life PHP branch (7.x, 8.0, 8.1)

EOL branches receive no upstream fixes — php2shell stays unpatchable there forever, and every future runtime CVE joins the pile.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
advisory

Runtime version disclosure (Server / X-Powered-By / generator meta)

The version string maps straight onto public exploit lists — it tells an attacker exactly which runtime to probe.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
high

phpinfo() pages served (phpinfo.php, info.php)

A phpinfo page hands over the full server inventory: paths, versions, extensions, environment.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
high

phpUnit eval-stdin endpoint served

The phpUnit RCE endpoint (CVE-2017-9841) executes posted input on ancient installs — reachable vendor trees are a classic web-root mistake.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
high

Laravel Ignition / Telescope reachable

Ignition carries the CVE-2021-3129 remote-code family; an open Telescope leaks application data, jobs and exceptions.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
medium

Composer inventory served (/vendor/composer/installed.json)

The exact dependency list with versions — target selection done for the attacker.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
high

Adminer or phpMyAdmin served to the public

A database panel on the public internet turns one weak password into total data loss.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
medium

Apache server-status served publicly

Request-level introspection of the whole server — URLs, clients, workers.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.
critical

Sensitive files served (.env, wp-config, .git, composer.json)

Credentials and app keys on the public internet — the fastest route from a scan to a breach.

🔒 Remediation locked — the exact fix is released to engaged customers once a transaction starts. Beat a hostile scanner to it: run the free check first.

Our own estate, checked by the same tool

No completed self-scan on file this minute — the next completed check of our own site will appear here.