Reads the PHP version running on a linked Joomla or WordPress site and reports whether that runtime includes the fixes for known vulnerabilities. Put it on a JOrchestrator cron…
Reads the PHP version running on a linked Joomla or WordPress site and reports whether that runtime includes the fixes for known vulnerabilities. Put it on a JOrchestrator cron so the check repeats.
When the flow reaches this step, JOrchestrator executes PHP Security against your linked site or an external integration, using the field values you set on General and Design. Downstream steps can read the output payload fields defined for this node.
PHP Security is a action step in the Security group. Action steps run in the middle or end of a flow. They perform work on your CMS, call external services, or transform data for the next step.
Typical reasons teams add PHP Security to a flow:
This step runs when the flow reaches it. On a JOrchestrator cron it repeats. It asks the linked site for the PHP version it is running and compares that version with the releases that fix known vulnerabilities. The releases it is checking now are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, published on 21 October 2026.
Common patterns on the canvas:
Link the flow to a domain. On the Design tab, turn on Fail when unpatched if this step should stop when the site is still exposed. Leave it off to always continue and let a later condition read the status field.
Those releases address CVE-2026-109618 and CVE-2026-109619. The same check covers later advisories as they are published. PHP 8.1 and older are reported as unsupported because the PHP project no longer ships fixes for them. This step reports status. It does not change PHP on the server. Patch the host, then let the cron run again.
The designer shows these tabs for this node:
| Tab | Purpose |
|---|---|
| Info | Plain-language description and output payload fields for downstream steps |
| General | Canvas label and read-only node ID |
| Design | Whether an unpatched or unsupported site should stop this step |
These fields are managed by the designer or runtime — you do not type into them directly:
| Property key | Label | Type | Required | Visible when | Notes |
|---|---|---|---|---|---|
_nodeId | Node ID | node-id | No | — | — |
_payloadFields | Available Fields | payload-panel | No | — | — |
| Property key | Label | Type | Required | Visible when | Notes |
|---|---|---|---|---|---|
label | Label | text | No | — | Node label |
| Property key | Label | Type | Required | Visible when | Notes |
|---|---|---|---|---|---|
failOnUnpatched | Fail when unpatched | checkbox (default: off) | No | — | Stop this step when the linked site is below a fixed release or on an unsupported PHP line. |
Credentials, API keys, mailers, SMTP, and integration defaults are configured in the CMS plugin under Node Configuration, not per step on this node. Link the flow to a domain before testing CMS-backed fields.
After this step runs, later nodes can reference these fields using placeholders such as {{php_security.phpVersion}}.
| Field key | Type | Description |
|---|---|---|
success | boolean | Whether the linked site reported its PHP version. |
phpVersion | string | Version string reported by the site, such as 8.3.36. |
sapi | string | How PHP is serving the site, such as fpm-fcgi or apache2handler. |
status | string | patched, needs-patch, or unsupported. |
patched | boolean | True when the reported version includes the fixes for the advisories this step checks. |
recommendedVersion | string | Lowest fixed release on the same supported line, when one exists. |
advisories | array | CVE ids the running version does not include fixes for. Empty when patched. |
message | string | Short status sentence for a later email or chat step. |