Most web servers run PHP, and PHP itself occasionally has serious security flaws — for example the October 2026 PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which let an attacker run code on an unpatched server with a single web request.
From the outside, a scan cannot reliably tell whether a server is patched. Most servers hide their PHP version, and when one is shown it can be misleading: hosts often apply security fixes without changing the version number, so a server reporting “8.3.35” may be fully patched or wide open. Guessing from the number would produce wrong answers in both directions.
The server check solves this. It is a small, read-only PHP file you place on your website. During each scan EzyAudit reads it to learn the real PHP version, the date your server's PHP build was made, and a few security settings — and then gives a definitive answer.
What the report will say
- PHP Up To Date — your version includes every security fix PHP has published for its branch.
- PHP Patched by Vendor Build — the version number is older than the fixed release, but your server's build is dated on or after the advisory, which is how most hosts deliver fixes. Marked informational; your host can confirm the details.
- PHP Missing Security Fixes — the version and the build both predate published fixes. Listed as critical or high, with each CVE named, and with a note when attackers are known to be exploiting it. This also creates an alert.
- PHP No Longer Receives Security Fixes — the branch (PHP 8.1 and older) is end-of-life, so no fixes are published for it at all. The only remedy is moving to a supported branch.
Without the server check, a scan can only comment when your server announces its PHP version in its headers, and then only cautiously (“confirm with your host”).
Install it
- Open your Dashboard, go to the Domains tab and click Server check next to a verified domain.
- Click Download file. On a phone, tap Copy code instead, then create a new file in your hosting file manager (or hosting app) and paste the code into it. Either way the file is made for that domain only.
- Name it
ezyaudit-server-check.php and put it in your website's root folder (the same folder as your home page, often called public_html, htdocs or www) using your hosting file manager, FTP or SFTP, so it would be reachable at:
https://yourdomain.com/ezyaudit-server-check.php
- Run a scan. The PHP status appears in the report under Outdated Software.
If you open that address in your browser you will see a “404 Not Found” page. That is expected: the file answers only EzyAudit, using a private key built into it. It does not mean the upload failed.
Is it safe?
- It reads nothing from your website or database and changes nothing. It reports only the PHP version, build date and four PHP settings.
- It responds only to requests carrying your domain's private key; anyone else gets a 404 with an empty body.
- It is a few lines of plain PHP you can open and read before uploading.
- You can delete it at any time; scans then fall back to the cautious header-only check.
Troubleshooting
- The file will not copy or download — some in-app browsers block both. Tap View the code, press and hold inside the box to select everything, and copy it by hand. Or open your dashboard in Chrome or Safari.
- The report still shows no PHP status — confirm the file is in the site root (not a sub-folder) and is named exactly
ezyaudit-server-check.php. Some hosts block or rewrite .php files outside the application; check for a security rule on that path.
- You changed the domain's verification — re-verifying a domain issues a new key, so download and upload the file again.
- Your host says PHP is patched but the report says fixes are missing — ask your host for the PHP build date. If it is older than the advisory, the fix is not in that build. If the build is newer and the report still disagrees, contact support with the scan ID.
Where the data comes from: PHP's own published security advisories, refreshed daily, with the fixed version for each PHP branch.