How the vulnerability wave check works

When a serious flaw in widely used software makes the news, attackers start scanning the internet for it within days. We call that a wave. For each major wave, Scanylo publishes a check page and adds the wave to every scan. This check compares what your site shows with the wave's affected and fixed versions.

What it reads

The result of the technology check: whether the affected product appears on your site, and which version it reports. It makes no requests of its own.

What it reports

For each current wave, one of these answers:

• Potentially affected: your site reports a version below the fixed release for its line. It is Potential, not Confirmed, because many hosting companies and Linux distributions apply the fix without changing the version number.
• Cannot tell: the product is on your site, but it does not show its version. Only your host or developer can confirm whether the fix is installed.
• Reported version is patched: the version your site shows is at or above the fixed release.
• Not affected: the product was not seen on your site at all. This one does not appear as a finding.

Earlier waves stay in every scan as background. They only become a finding when your site shows a version below their fix; their other answers are listed in the report's earlier-waves section.

What it cannot see

• Fixes applied without a version change (the reason for "potentially affected").
• Software versions your site does not show (the reason for "cannot tell").
• Whether the flaw can actually be reached on your site. That depends on configuration we cannot see from the outside.

What to do with the result

For "potentially affected" or "cannot tell", ask your host whether the fixed release, or their own fix for your version, is installed. Each wave page lists the fixed versions and the official sources.