JAZ-X PHP Security Guardian

JAZ-X PHP Security Guardian is a free administrator-only security advisory dashboard. It helps site owners check whether their PHP version meets the upstream fixes published on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619.

Features:

• Shows PHP runtime version and compares it to the published patched releases for PHP 8.2, 8.3, 8.4, and 8.5.
• Warns administrators when their PHP release is below the upstream fix threshold.
• Provides links to official PHP security guidance.
• Shows cached WordPress core, theme, and plugin update counts.
• Shows WP_DEBUG and PHP display_errors configuration status.
• Lets administrators record a hosting provider’s written backport or mitigation statement without treating it as independently verified.
• Optionally sends administrator emails when a potentially affected PHP runtime is newly detected or its reported version changes, using WordPress cron.
• Keeps all checks read-only; no automatic file modifications, remote scans, or PHP version changes.

Important limits:

• This plugin does NOT patch PHP vulnerabilities or block exploit traffic. Some exploits can run before WordPress loads.
• A version-number comparison alone cannot determine whether a host has vendor backports or external mitigations.
• A patched PHP version does not imply a WordPress site is entirely secure.
• The included CVE thresholds are a reviewed static snapshot, not a live vulnerability database. Future advisories require plugin updates.
• WordPress cron depends on site activity and is not a guaranteed exact-time security alert mechanism.