How much does Feli-Scan Protect cost?

$99 per month plus a one-time $999 Deep Scan & Fix, which can be paid as 5 monthly payments of $199.80. The scan itself is free.

Does Feli-Scan cover data security and AI security?

Yes. It looks for exposed configuration and backup files that leak passwords and customer data, checks that email cannot be spoofed in your name, and hardens sites against automated and AI-driven attacks. For businesses that need AI kept private, Felican AI also deploys Private AI inside your own network.

Threat feed

LiveTwo critical PHP2Shell flaws put about 70% of websites at risk
CNNNSA and Europe’s cyber agency tell companies to take immediate action
CloudflareMillions of attempts to exploit the flaws in the first days
NPRDozens of UK and Finnish government services taken offline
FixUpdate PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35
CISACan’t patch yet? Take the site offline or put a firewall in front
AIResearchers used AI to uncover the decade-old bug
TipTurn on two-factor sign-in for every website admin
TipPublish DMARC so criminals can’t email your customers as you
TipKeep daily off-site backups and test a restore
ThreatLeaked API keys in page code are a top target for automated bots
TipRemove plugins you don’t use: inactive plugins can still be exploited

LiveTwo critical PHP2Shell flaws put about 70% of websites at risk
CNNNSA and Europe’s cyber agency tell companies to take immediate action
CloudflareMillions of attempts to exploit the flaws in the first days
NPRDozens of UK and Finnish government services taken offline
FixUpdate PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35
CISACan’t patch yet? Take the site offline or put a firewall in front
AIResearchers used AI to uncover the decade-old bug
TipTurn on two-factor sign-in for every website admin
TipPublish DMARC so criminals can’t email your customers as you
TipKeep daily off-site backups and test a restore
ThreatLeaked API keys in page code are a top target for automated bots
TipRemove plugins you don’t use: inactive plugins can still be exploited

AI security scan & repair system

As reported by

See the coverage ↓

of websites run the software AI just found a way to break into. Unpatched sites can be taken over with no password.

Is your website exposed? Find out in 30 seconds.

Two critical PHP flaws just made most websites hackable with no password needed. Feli-Scan checks your site free, shows you every weakness in plain English, and fixes it within 24 hours.

27 passive checks from the outside. No login, nothing to install, nothing changes on your site. Runs on felican.ai; you watch every check live.

In the news

This is not a sales pitch. It is the week’s biggest security story.

CBS News · Video · 4:57 · Oct 21, 2026 AI discovers bug that puts up to 70% of websites at risk A plain-language explainer: what the PHP flaw is, why it matters to every business with a website, and why authorities say patch now or go offline. Watch the explainer →

CNN · Oct 21, 2026Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet Associated Press · Oct 22, 2026Rush is on to patch a software vulnerability that could impact 70% of websites worldwide NPR · Oct 23, 2026Hacking attempts rise after flaws found in program affecting 70% of websites CISA (U.S. government) · Oct 21, 2026Critical vulnerabilities in PHP require immediate patching

Each story opens a short summary here, with a link to the original reporting. Feli-Scan is not affiliated with these publishers.

Why now

Two bugs in PHP itself put most small-business websites at risk.

On October 21, 2026 PHP shipped emergency releases for CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. The flaws sit in the engine that runs WordPress, WooCommerce, Joomla, Drupal, Magento and most agency-built sites, so an unpatched site can be taken over without a password or any mistake in its own code. US cybersecurity authorities told organisations to patch immediately or take PHP sites offline.

No password needed

Attackers can take over an unpatched website without ever logging in.

7 in 10 websites

Run the affected software, including most WordPress sites.

Fixed in 24 hours

Scan free to see where you stand. We fix what we find within a day.

PHP2Shell explained, and what to do today →

What Feli-Scan checks

27 website security checks, the same things attackers look for first.

PHP2Shell exposure and PHP patch level
Server and PHP version disclosure
WordPress, Joomla, Drupal and Magento versions
WordPress plugins behind their latest release
Admin logins reachable by anyone
XML-RPC password-guessing endpoint
HTTPS enforcement, TLS certificate and HSTS
Security headers: CSP, frame, content-type, referrer
Exposed .git, .env and config backups (data leaks)
Open directory listings and readme files
Outdated jQuery and Bootstrap with known flaws
Firewall or CDN in front of the site
Cookie security flags
Insecure mixed content
SPF and DMARC: can criminals email as you?
Forms without bot protection
Leaked API keys and private keys in the page and its scripts
Exposed database dumps, backup archives, logs and credentials files
WordPress usernames listed publicly
Open phpMyAdmin, Adminer and server-status panels
Cross-site access rules (CORS) that leak signed-in data
Outdated TLS 1.0 / 1.1 and CAA certificate controls
Third-party scripts without integrity protection
A published security contact (security.txt)

1 · Scan

Enter your address and watch every check run live.

2 · See

Your A–F grade and every finding, instantly.

3 · Unlock

Evidence and the exact fix, emailed into your private security vault.

4 · Fix

We patch, clean up and harden it within 24 hours, then keep it protected.

Website, data and AI security

More than a website check.

Website security

Patching PHP and your CMS, removing vulnerable plugins, closing exposed logins and endpoints, and putting a web application firewall in front of the site.

Data security

Finding exposed configuration files, backups and listings that leak passwords and customer data, stopping email spoofing in your name, and setting up tested, off-site backups.

AI security

Hardening against automated and AI-driven attacks: bot and rate protection, no version giveaways, locked-down forms. Need AI kept private too? Private AI runs inside your own network.

Pricing

The scan is free. The fix is fast.

$99/month

+ $999 one-time Deep Scan & Fix. Payment plans available: 5 × $199.80.

Deep Scan & Fix within 24 hours of access: patching, clean-up and hardening, with a written report
Web application firewall from day one
Weekly AI re-scans with alerts, patches within 24 hours of release
Daily off-site backups and a monthly report for you or your insurer

Scan my website free Get Feli-Scan Protect Sample report

Site too old to patch? We quote a secure rebuild on a modern stack with no PHP to exploit.

Questions

What is PHP2Shell?

Two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026 and rated 9.2 out of 10. Any PHP site not updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 can be attacked without a password. PHP 8.1 and older will not be fixed.

Is the free scan safe?

Yes. It only reads what your website already shows every visitor. It never logs in, never attempts an exploit and never changes anything. The paid Deep Scan goes further, and only with your written authorization.

How much does it cost to fix?

Feli-Scan Protect is $99 per month plus a one-time $999 Deep Scan & Fix (or 5 monthly payments of $199.80). Sites needing substantial rework are quoted before any extra work.

Do you cover data security and AI security?

Yes. The scan finds files and settings that leak data, checks whether your email can be spoofed, and the fix hardens your site against automated and AI-driven attacks. For keeping your own AI use private, see Private AI.

Who is behind Feli-Scan?

Felican AI, a team of certified AI professionals in Palm Beach County, Florida, working with businesses nationwide. Call (561) 264-7166 or email [email protected].