Security advisory: Urgent: Two Critical PHP RCEs (CVE-2026-109618, CVE-2026-109619) Website security scanner

Know where your website stands.

Scan for real security issues, get a clear report and take action with confidence.

TCSR scan page for example.com: security grade B and four findings — exposed .env file (critical), missing HSTS header (high), missing Content-Security-Policy (medium) and DMARC policy none (low)

TCSR

Overview Findings4 Compliance relevance DNS records HTTP security headers SSL/TLS certificate Technology fingerprint

example.com

Audit scan · 27 Oct 2026, 09:40

Good security posture

4 findings require attention, out of 19 checks.

Exposed: /.env Critical

Missing header: HSTS High

Missing header: Content-Security-Policy Medium

DMARC policy is "none" Low

Illustration · sample data

Evidence

Evidence you can hand over.

Get a clear, shareable report with findings, technical details and practical recommendations.

See what a report contains

First page of a TCSR PDF report for example.com with the reference, assessment type, date, overall grade B and a summary of four findings

TCSR Confidential
TCSR-SAMPLE-K7Q2M9XD

Security Assessment Report

Domain: example.com
Assessment type: Audit — full active
Date: 27.10.2026 09:40
Reference: TCSR-SAMPLE-K7Q2M9XD

Overall grade B

Executive summary

1 Critical 1 High 1 Medium 1 Low

Findings

Talivio Technology OÜ · Tallinn, Estonia · /verify · SHA-256

Demo

The free scan, in one minute.

A narrated, captioned walkthrough: scan a domain with no account, see its external exposure and what verifying ownership unlocks.

Scan your domain free.

The video scans badssl.com, a public website built for testing.

Checks

What we check.

19 security modules covering your site, server and email setup.

All 19 modules

Six of the 19 TCSR scan modules with a short description and the number of findings each produced in a sample scan

SSL/TLS certificate Validity, issuer and expiry 0 findings

HTTP security headers HSTS, CSP and other response headers 2 findings

Email security (SPF/DMARC) SPF and DMARC records 1 finding

Exposed sensitive files .git, .env and backup files 1 finding

Platform & version CMS, plugins and known vulnerabilities 0 findings

Open ports Services reachable from the internet 0 findings

Illustration · sample data

AI assistants

Or just ask your AI assistant.

Connect ChatGPT, Claude, Cursor or VS Code to TCSR. It reads your scans and reports, explains each finding with the fix, and starts a scan only after you say yes.

How to connect

Read only by default; you choose all your domains or one, and how much it may do
Only verified domains are scanned, and only after your yes in the chat
Billing, plan changes and deleting domains stay in TCSR

Get started