Your server says PHP is patched. Is the web server using that PHP?

Run php -v over SSH and you learn which PHP your terminal uses. Your website may be using a different binary, with a different php.ini.

That matters when a flaw like PHP2Shell (CVE-2026-109618, CVE-2026-109619) lands. Updating a package doesn't always restart the running service, and composer audit was never meant to check the runtime.

Check what's really running

I built php-security-check, a free, MIT-licensed CLI with no dependencies:

composer require --dev phpscientist/php-security-check vendor/bin/php-security-check . 

It reports on PHP version and known core flaws, php.ini settings, Composer packages, and Laravel, Symfony and WordPress mistakes. Each finding comes with the exact fix.

Read the web server's real values

php-security-check probe --dir=public 

The probe has a random name, needs a secret token, returns only the version and the settings the tool checks, and deletes itself after one use or 15 minutes. Only use it on servers you're responsible for.

Add it to CI

- uses: phpscientist/php-security-check@v0
 with:
 php-version: '8.4.20'
 fail-on: high
 

What it won't do

It doesn't scan your code or tell you whether a vulnerable feature is reachable. Think of it as a fast check of your runtime and configuration, not a security review.

Code and docs: https://github.com/phpscientist/php-security-check
I also keep a plain-English list of current PHP CVEs: https://phpscientist.com/php-security-advisories/