GVPH PHP Scanner · Version 1.8.0
Review websites.
Find your next fix.
Check public websites here, or launch the local scanner for internal websites and devices. Review PHP evidence, security settings and official update guidance.
Portable ZIP · Windows x64 · 34.5 MB · Includes its runtime
Updated October 23, 2026 · Deeper website review, software evidence and vendor handoff reports
Choose where the check runs.
Public checks run on GVPH’s server. Internal scans and their reports stay on your computer.
A little context goes a long way
Understand the finding.
Know your next step.
New to PHP or sharing a result with a colleague? The learning hub explains the risks with short videos, plain-language guidance and quick activities.
No download for public sites
Check a website here.
Review linked pages and JavaScript on a public website you administer. Find software clues, supported vulnerable-version matches, exposed diagnostics, insecure forms and configuration gaps. See DNS addresses, aliases and connection outcomes alongside evidence and concrete next steps for your website vendor.
Internal sites and networks
Launch from this page.
Scan on your computer.
Private devices need a local helper. Set it up once on Windows, then use this button on future visits. Your local scan opens in its own browser tab and starts only after you review and confirm the targets.
Open local scanner →First visit on this computer?
- Download the one-time Windows setup.
- Run the downloaded file. It verifies and prepares the scanner in your Windows profile, then opens it.
- Enter an internal website URL, device address or subnet in the local scanner. Expand Website security observations in the results.
Flexible scopeSubnets, individual devices, hostnames or saved target lists.
Useful reportsFallback check history, device identification, CSV and HTML reports.
Update guidanceOfficial vendor update links beside findings, plus server update helpers.
From download to findings
Prefer the portable ZIP?
Use a Windows computer that can reach the network you want to assess. Administrator rights are not needed to run the scanner.
- 1
Extract and open
Extract the entire ZIP, then open Start-PHP-Network-Audit.cmd. The GVPH interface opens in your browser. Keep the launcher window open while you work.
- 2
Choose and review your targets
Enter your devices or subnet, or load a text list. Thorough checks are enabled in the new download. Use the optional 30-port preset for broader management-port coverage. The starting address is editable. Select Review scan, confirm the exact scope and your authorization, then start.
- 3
Review, update and verify
Use Results to prioritize follow-up. Export your findings, use the Update guide, and verify the deployed runtime or vendor firmware after updating.
Understand the result
Evidence first.
Verification follows.
This is an IPv4 inventory and version-triage tool. It sends ordinary unauthenticated web requests, checks common configurable web ports, and records PHP indicators when available. It does not send exploit payloads or start a scan automatically.
These checks identify observations, not confirmed exploits or a guarantee of safety. SQL injection, XSS, authenticated access, malware, backend source code and full TLS configuration are not tested. A missing PHP header or an unreachable device is not a clean result. Hidden runtimes, authentication, virtual hosts, containers, IPv6 and other ports may need separate inspection. Vendor backports can fix older version numbers.
Appliances, NAS devices and firewalls require their vendor's firmware or product updates. The included Debian/Ubuntu updater is for ordinary servers and requires review and confirmation. Patching alone does not remove an existing compromise.
Release details
Download with confidence.
The package includes the Windows runtime and its license. The original runtime signature and upstream checksums were verified during packaging. The GVPH launcher scripts are not separately code-signed.
Follow your organization's software policy. If execution is blocked, ask your IT team to review the package.
Download the ZIP checksum →- Version
- 1.8.0
- Platform
- Windows 10/11 x64 and compatible Windows Server desktops
- Scan rules reviewed
- October 23, 2026
- Package size
- 34.5 MB
- SHA-256
- 74d1aa2062d0f7661d05a6d71f736b945c2b006c27278632cbcc796da9393852
A few practical details
Does the website checker find every vulnerability?
No. It performs passive checks on bounded response samples. Findings can require application-specific review. For authenticated application testing, injection flaws, authorization errors or a comprehensive dependency inventory, arrange a separately scoped application-security assessment.
How can I verify PHP when the public version is hidden?
PHP runs on the server. Its version header can be disabled, and proxies or caches may hide the origin. A missing header does not prove PHP is absent, vulnerable or patched. An advertised number is only a clue.
For WordPress, an administrator can check Tools → Site Health → Info → Server. Otherwise, ask the hosting administrator to verify the PHP runtime and patch status assigned to this exact site. A command-line php -v result may describe a different installation from the one serving the website.
Keep normal version-hiding settings in place. The results include verification steps and wording you can send to your host.
What can DNS tell me?
The report shows IPv4 addresses, any returned DNS aliases and the address that answered each request. Proxy response headers are labeled as clues. DNS does not verify the hosting company, origin server, PHP version or patch status. IPv6 is not covered, and reverse DNS may be missing or stale.
Which option keeps internal information on my computer?
The local scanner. It connects directly to the networks your computer can reach and stores reports locally. The hosted checker accepts public website names only. It cannot reach a colleague’s private network.
Where are my reports saved?
In your Windows user profile under %LOCALAPPDATA%\GVPH\PHP Scanner\reports. Select Open saved reports in the app. Reports persist after the app closes; retain or remove them under your organization's policy.
Can I change the subnet or scan several networks?
Yes. Enter IPv4 CIDRs, individual addresses, DNS hostnames or explicit HTTP/HTTPS URLs. Add multiple entries separated by commas or new lines. Verify that you are authorized and that the scanning computer can reach each network.
What happens when a device returns little information?
Thorough checks retry transient failures, compare header-only responses, read compressed pages and try three common entry pages on root targets. For incomplete internal IP responses, it also checks reverse DNS and retries up to two hostnames only when their forward DNS points exclusively to that original IP. Every connection stays pinned to the original device and selected ports. Expand DNS and connection details or Check history to see each outcome. Authentication and hidden PHP versions may still require firmware or host inventory.
Already using an older release? Download this ZIP, extract it into a new folder and launch that copy. Existing copies do not update automatically.
Does it automatically patch devices?
No changes are made by scanning. The included Debian/Ubuntu helper previews its package plan and offers a separately confirmed update when run on the intended server. Windows and vendor appliances use their matching runtime or firmware procedures.
Which advisory does it address?
The October 2026 php2shell advisories, CVE-2026-109618 and CVE-2026-109619. The dated rules use PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as upstream baselines. Review the CERT-EU advisory and NCSC vendor information for current details.
Ready to review your network?
Download, extract, and choose your authorized scope.