Safety

PHP vulnerability emails and fake scanners: how site owners can verify them

PHP Site Audit · Updated 2026-10-25

The direct answer

Verify the vulnerability through the PHP project or your operating-system vendor, and contact your host using a support portal or address you already trust. Do not click an unexpected scanner link, run an attached tool, share credentials, or pay for an urgent ‘repair’ based only on an email. A real advisory does not authenticate the person who contacted you.

A real advisory does not verify the sender

A scam message can borrow a real CVE number, PHP release date, or security logo. Its technical claim may be partly true while the sender's identity and proposed service remain unverified. Treat the advisory and the sales message separately: read PHP's official notice directly, then independently contact your host.

Warning signs include pressure to act immediately, a link to an unfamiliar scanner, an attachment described as a required patch, requests for administrator credentials or one-time codes, payment by gift card or cryptocurrency, and a domain that imitates your provider. These clues justify caution; their absence does not authenticate a message.

You can also ask your host whether it has published a customer notice, but navigate to the official account portal yourself. Do not let an unsolicited sender define the deadline, payment method, or verification process. If the host confirms that a real update is needed, keep working that issue through the provider while separately reporting the suspicious message to your email or security team.

Verify through a channel you choose

Open the host's support site from a saved bookmark, type its known address, or use the phone number on an account statement or official portal. Ask whether PHP serves your specific domain and whether the provider has applied the relevant vendor fix. If a developer sent the message, contact them using details from your contract or verified correspondence.

The FTC advises contacting a company through a phone number or website you know is real rather than details in a suspicious email. Keep the original message and note when it arrived. Do not forward it with sensitive customer data or credentials attached.

Check what the sender is selling

Ask for the exact CVE, affected runtime, vendor advisory, and a description of what the proposed scan checks. A public HTTP scan cannot install a server update or inspect a private PHP package. If a provider claims to have found an issue, ask for hostname, time, observable evidence, scan scope, and limitations in writing.

Be wary of ‘guaranteed safe’ or ‘complete protection’ claims. A scan may detect a public clue or an issue within scope, but it cannot prove a server was patched, establish the absence of hidden services, or prove a site was not compromised. Ask your host to verify server-side facts.

If you already clicked or paid

If you entered a password, change it from the legitimate service's site and revoke active sessions or tokens where possible. If reused, change it on other accounts too. Enable multifactor authentication. If you installed a tool or attachment, contact your IT or hosting support team and follow their device-security guidance.

If you shared payment or identity information, contact the relevant bank or provider using a known number and follow official reporting steps. Preserve the message, payment receipt, sender address, and timestamps. Report suspected phishing through channels recommended by your email provider or consumer-protection authority.

A polished design, a familiar logo, or a sender display name is easy to copy. If an email claims that your site was scanned, ask what domain was checked, when, what public observation was made, and whether the sender can provide a report without asking you to install software. Then verify the company independently. Do not give an unknown person remote access to your computer or hosting account to ‘show’ you a finding.

Urgency itself is not proof that a message is fake; security updates can require prompt attention. The safe response is to act through a trusted channel, not to ignore the underlying advisory. You can read the PHP notice directly, open a support case with your provider, and separately report an impersonation attempt. This preserves urgency for the real technical work while withholding trust from an unverified sender.

Verification checklist

Do not use links or contact details from the unsolicited message.
Read the advisory on the official PHP or vendor site.
Open a host case through a known portal.
Request domain-specific runtime and patch evidence.
If credentials or money were shared, secure the account and report through official channels.

Common questions

Should I click the scanner link to see if it is legitimate?

No. Reach the company or host through a known official channel and ask for the evidence independently.

What if the email names a real CVE?

Verify the CVE on the PHP or vendor site. A real CVE does not prove that the sender is authorized.

What if I already gave them a password?

Change it on the legitimate service, revoke sessions or tokens if available, enable MFA, and contact the provider through its known support channel.