ཞིབ་བརྗོད།
JAZ-X PHP Security Guardian is a free administrator-only security advisory dashboard. It helps site owners check whether their PHP version meets the upstream fixes published on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619.
Features:
- Shows PHP runtime version and compares it to the published patched releases for PHP 8.2, 8.3, 8.4, and 8.5.
- Warns administrators when their PHP release is below the upstream fix threshold.
- Provides links to official PHP security guidance.
- Shows cached WordPress core, theme, and plugin update counts.
- Shows WP_DEBUG and PHP display_errors configuration status.
- Lets administrators record a hosting provider’s written backport or mitigation statement without treating it as independently verified.
- Optionally sends administrator emails when a potentially affected PHP runtime is newly detected or its reported version changes, using WordPress cron.
- Keeps all checks read-only; no automatic file modifications, remote scans, or PHP version changes.
Important limits:
- This plugin does NOT patch PHP vulnerabilities or block exploit traffic. Some exploits can run before WordPress loads.
- A version-number comparison alone cannot determine whether a host has vendor backports or external mitigations.
- A patched PHP version does not imply a WordPress site is entirely secure.
- The included CVE thresholds are a reviewed static snapshot, not a live vulnerability database. Future advisories require plugin updates.
- WordPress cron depends on site activity and is not a guaranteed exact-time security alert mechanism.
སྒྲིག་འཇུག
- Upload the plugin ZIP using Plugins > Add New > Upload Plugin.
- Activate JAZ-X PHP Security Guardian.
- Open Tools > PHP Security Guardian.
- Review the PHP report and contact your hosting provider for any vendor-specific patch/backport confirmation.
- Optionally save a hosting response and configure email alerts.
FAQ
-
Does this plugin fix CVE-2026-109618 and CVE-2026-109619?
-
No. Only a security-patched PHP runtime (including correctly applied, vendor-supported backports) addresses the underlying problem. This plugin is a monitoring and guidance tool.
-
Is the PHP version warning proof my host is exploitable?
-
No. Some hosts use security backports or other controls which a WordPress plugin cannot verify. Ask your provider for a written statement and prioritize a supported patched runtime.
-
Does it send any site information to an outside service?
-
No. This version has no external telemetry or vulnerability scanning API calls. WordPress’ own built-in update checking operates separately. Optional alert emails go to the site’s configured administrator address.
-
Does it modify PHP or WordPress settings?
-
No. Checks are read-only, except plugin preferences and alert state stored locally in the WordPress options table.
གདེང་འཇོག
There are no reviews for this plugin.
བྱས་རྗེས་འཇོག་མཁན། & གསར་འབྱེད་པ།
“JAZ-X PHP Security Guardian” is open source software. The following people have contributed to this plugin.
བྱས་རྗེས་འཇོག་མཁན།
ཁྱེད་ཀྱི་སྐད་ཡིག་ནང་ལ་ “JAZ-X PHP Security Guardian” ཡིག་སྒྱུར་བྱོས།
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
དག་བཅོས་ཉིན་ཐོ།
1.0.2
- Match translation text domain to WordPress.org assigned plugin slug. No changes to monitoring or settings.
1.0.1
- Added WordPress.org readme compatibility header and language directory.
- Documented read-only success notice nonce exception for static analysis.
1.0.0
- Initial PHP advisory dashboard for the two October 2026 critical vulnerabilities.
- Added version threshold check, administrator warning, cached update signals, host notes, and optional daily email alerts.