NEXIAL launches free website security pre-check after PHP, Node.js flaws
NEXIAL Security needs only a URL to run an external check and supports JSP and other environments beyond PHP and Node.js, the firm said.
South Korean software developer NEXIAL announced on October 23, 2026, that it is offering a free website security pre-check service, NEXIAL Security, aimed at corporate sites after recent vulnerabilities in PHP and Node.js.
The service requires only the website's URL, with no installation or sign-up, and supports JSP and other environments in addition to PHP and Node.js, according to dailysecu.com.
NEXIAL cautioned that the tool performs a preliminary check of externally visible settings and does not definitively detect every risk or verify whether internal patches have been applied.
The company's marketing team leader, Kim Min-jun, said companies need to re-check the security of their websites, and pointed to the free service along with follow-up improvement and maintenance support.
Alert level raised
The launch follows a decision on October 22, 2026, by the Ministry of Science and ICT and KISA to raise the private-sector cyber crisis alert from "interest" to "caution" over PHP vulnerabilities. Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed with a CVSS 4.0 score of 9.2 and could allow remote code execution. The PHP team released security updates 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, 2026, the same day Node.js published an update fixing DNS name handling errors and a TLS certificate hostname verification bypass using certain IP addresses.
Quick answers
What is NEXIAL Security?
It is a free website security pre-check service from NEXIAL that requires only a website URL, with no installation or sign-up.
Which environments does the pre-check support?
It supports PHP, Node.js and other environments including JSP.
Does the check confirm every vulnerability?
No. NEXIAL says it is a preliminary check of externally visible settings and does not definitively detect all risks or verify internal patch status.