Feli-ScanAI security scan & repair system

Active threat PHP2Shell · CVE-2026-109618 & CVE-2026-109619 · CVSS 9.2 · emergency patches released Oct 21, 2026

Two critical PHP flaws just made most websites hackable. Is yours one of them?

Roughly three out of four websites run PHP. Until a site is patched, an attacker needs no password and no bug in your code to take it over. Feli-Scan checks your site in under 30 seconds, free.

19 passive checks from the outside, the way a visitor’s browser sees your site. No login, nothing to install, nothing changes on your site.

  • 9.2 / 10Severity of both flaws (CVSS v4). Unauthenticated remote code execution.
  • PHP 5.4 → 8.5.11Every version from the last 14 years is affected. PHP 8.1 and older will never get a patch.
  • Exploits publicProof-of-concept code is circulating and attack attempts were seen within 24 hours.
Scan, fix, protect

Patched in 24 hours. Protected every month after.

Most small-business websites were built years ago and have never had a security pass. Feli-Scan finds what is exposed; our certified AI professionals fix it and keep it fixed.

Most businesses start here

Feli-Scan Protect

$99/month

+ $999 one-time Deep Scan & Fix. Payment plans available.

  • Deep Scan & Fix within 24 hours: authorized full scan, PHP and CMS patched, vulnerable plugins updated or removed, malware sweep, hardening, written report.
  • Web application firewall in front of your site from day one.
  • Weekly AI re-scans with alerts the moment something changes.
  • Security patches applied within 24 hours of release.
  • Daily off-site backups and a monthly report you can hand your insurer.
See Feli-Scan Protect →

Secure Rebuild

Quoted

For sites too old to patch, or businesses that want this never to happen again.

  • Rebuilt on a modern stack with no PHP to exploit.
  • Hardened against automated and AI-driven attacks.
  • Faster, mobile-first, ready for search and AI answers.
  • Content, branding and rankings carried over.
  • Includes the first year of Protect.
Talk about a rebuild →

Not sure what you have?

Free

A 15-minute call with a certified AI professional.

  • We walk through your scan results together.
  • Find out who hosts your site and what patching takes.
  • A straight answer on fix or rebuild.
Book a call →
What Feli-Scan checks

19 checks, from the outside, in under 30 seconds.

  • PHP in use, and whether it is on a PHP2Shell-patched release
  • Server and PHP version disclosure
  • WordPress, Joomla, Drupal and Magento detection and version
  • WordPress plugins behind their latest release
  • Admin login pages reachable by anyone
  • XML-RPC left on
  • HTTPS enforcement and TLS certificate health
  • HSTS, CSP, frame, content-type and referrer headers
  • Exposed .git, .env, config backups and phpinfo
  • Directory listings and readme files
  • Outdated jQuery and Bootstrap with known flaws
  • Firewall or CDN in front of the site
  • Cookie security flags
  • Insecure mixed content
  • Email spoofing protection: SPF and DMARC
  • Forms without bot protection

  1. Scan

    Enter your address and watch every check run live. No login, no exploit, nothing changes.

  2. Unlock

    Your grade and findings appear instantly. Unlock the evidence and the fix for each by email, into your private security vault.

  3. Fix

    With your written go-ahead we run the full Deep Scan, patch, harden and confirm it is closed, within 24 hours.

  4. Protect

    Firewall, weekly AI re-scans, patches within 24 hours, daily backups and a monthly report.

Want to see the depth of the paid work? Read a sample Deep Scan & Fix report. Already scanned? Open your security vault.

Questions

What is PHP2Shell?

The name given to two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. Both are rated 9.2 out of 10. Because the bugs are in PHP itself rather than in any one website’s code, any PHP site not updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 can be attacked without a password. Sites on PHP 8.1 or older will not receive a fix.

Is the free Feli-Scan safe to run?

Yes. It only reads what your server already sends to every visitor: headers, the page source, the certificate, a few well-known public addresses and your public DNS. It never tries an exploit, never logs in and never changes anything. The Deep Scan goes further, and only with your written authorization.

Why do I need an email to see the details?

Your grade and every finding title show instantly. The evidence and the fix for each finding go into a private security vault tied to your email, so the specifics about your site’s weaknesses are not shown to whoever happens to type in your address.

My site was built by someone else. Can you still fix it?

Almost always. We need access to your hosting account, or an introduction to whoever has it. If the site is too old to patch, we tell you plainly and quote a rebuild.

I don’t know if my site uses PHP.

Run the scan. WordPress, WooCommerce, Joomla, Drupal, Magento and most agency-built sites from before 2024 run on PHP.

Do you work with businesses outside Florida?

Yes. Everything is done remotely, for clients nationwide.

Find out in under 30 seconds.

If your site is exposed, every hour counts. If it is not, you will know for sure.