Why PatchScope exists
PHP runs a large share of the web, from small business sites to large content platforms. Many of those sites still run PHP versions that are outdated or no longer supported by the PHP project, often without their owners knowing.
The information needed to answer a simple question such as “is my PHP version still safe to run?” is spread across release pages, changelogs, security advisories, CVE records and distribution trackers. Each source uses its own format and terminology, and few of them answer the question directly.
PatchScope brings that information together. It aims to give clear, honest answers, with the sources shown, so that site owners, developers and agencies can make informed decisions about upgrades.
What it offers
- PHP Version Checker: enter a PHP version and see its branch support status and the known PHP engine advisories that affect it. The check runs entirely in your browser.
- CVE Lookup: search the same curated dataset by CVE ID, GHSA ID or keyword.
- Website Security Checker: run passive checks on a public website you own or are allowed to test, covering HTTPS, security headers, version disclosure, cookie flags and a short list of commonly exposed files.
The core tools are free.
Who it is for
- Site owners who want to know whether the PHP version their host reports is still supported, without reading release notes and advisories.
- Developers and agencies who maintain many sites and need a quick, sourced reference before planning upgrades.
- Hosting and operations staff who want to see which advisories apply to a given upstream version, and where the version number alone is not enough to decide.
PatchScope is a starting point for these decisions, not a replacement for a security review of your own systems.
Principles
- Accuracy over alarm. We would rather say “insufficient information” than overstate a risk or invent certainty.
- Never claim “secure”. A tool can report what it observed, not prove the absence of problems. No PatchScope result says a version or site is secure.
- Show sources and uncertainty. Every advisory shows its sources, its reviewed date and its verification level. Known limitations, such as distribution backports, are stated where they matter.
- Privacy by default. The PHP checker and CVE lookup run locally in your browser. There are no accounts and no database of user inputs.
- Free core tools. The checkers that answer the basic questions remain free to use.
How it is built
PatchScope is a static website. Version checks and CVE searches run in your browser against a versioned data snapshot, with minimal JavaScript. The website checker is the only tool that runs on a server, because it has to fetch the site you enter; it does so with strict safeguards described in the methodology.
We are open about how results are produced. The methodology page documents the data sources, matching rules, statuses, website checks and known limitations, and the code is available on GitHub.
What PatchScope cannot tell you
Being clear about limits is part of giving honest answers. A PHP version number alone cannot show whether a hosting provider or Linux distribution such as Debian, Ubuntu or RHEL has backported a security fix. The website checker sees only what a site exposes in its responses, and an external scan cannot see server configuration, plugins, file permissions or application code. The advisory dataset is curated rather than exhaustive, so a CVE missing from it is not evidence that the CVE does not exist. Results state these limits where they apply.
Roadmap
The following items are planned. None of them are available yet.
- More languages: Japanese, Spanish, German, French and Portuguese, in addition to English and Korean.
- Scheduled data updates: moving the current reviewed, scripted update process to a scheduled job.
- Optional downloadable reports of check results.
- Professional services, such as website security assessments, WordPress update assistance, and technical SEO and performance work. These would be offered separately from the free tools, under their own terms.
Independence
PatchScope is an independent project operated by evoa.one. It is not affiliated with, endorsed by or sponsored by the PHP Group, The PHP Foundation, WordPress or Automattic. Product names are used only to describe compatibility and data sources.
Questions, corrections and feedback are welcome through the contact page.