Free PHP Vulnerability Audit for FileMaker Customers
If PHP is anywhere in your FileMaker estate, you need to act today. We're offering a free audit to any FileMaker customer, Neptune client or not.
- Official Claris Partner
- Over a hundred projects delivered
- A UK team of around 25
Trusted by clients from global brands to local charities
Critical PHP vulnerabilities disclosed worldwide
Global emergency guidance
The UK NCSC, US NSA and agencies across the EU, Australia and Singapore have issued emergency guidance on newly disclosed PHP vulnerabilities.
Major sites taken offline
The BBC, Edinburgh Council, Wikimedia and a string of Scottish health boards have taken sites offline as a precautionary measure.
Patch or take it down
The advice is blunt: patch immediately, or take the system down until you can. The NSA says these flaws provide a 'direct path' to exploit databases.
Exploitation attempts rising
With technical details now public, more attempts to exploit these flaws are likely in the coming weeks.
Where PHP hides in a FileMaker estate
The Claris Data API, OData and REST have replaced the FileMaker PHP API almost everywhere. But "rare" means there are still systems out there, quietly running, often with nobody left who remembers how they were set up.
What the free audit covers
We'll check your website, payment flows, integrations and any FileMaker PHP layer, tell you what's exposed, confirm whether it's patched, and look for signs of compromise.
- Inventory every PHP surface in your environment
- Confirm PHP version and patch state
- Review FileMaker Server web publishing configuration
- Check payment flows and external integrations
- Look for indicators of compromise and backdoors (per NCSC guidance)
- Provide a written summary with prioritised actions
- Recommend options to retire the PHP API in favour of the modern Data API or OData
How it works, in three steps
Who it's for
Any FileMaker customer
Neptune client or not. UK and Ireland. No cost. No obligation. We'd rather you found out from us than from an attacker.
What clients say.
Frequently asked questions
Still not sure? Get in touch and we'll answer any questions.
Yes. We're offering this as a public service in response to the NCSC emergency guidance. There's no cost and no obligation to buy anything from us afterwards.
Not necessarily. We can check a lot externally. If deeper access is needed (for example, to verify FileMaker Server configuration), we'll discuss that with you first.
Absolutely. 'Not sure' is the most common answer. That's exactly what this audit is for: we'll tell you what's there.
We'll tell you immediately and walk you through your options. If you need help patching or migrating, we can quote for that separately, but there's no pressure.
The Health Check is a comprehensive 100-point review of your entire FileMaker estate. This PHP audit is narrowly focused on the current vulnerability and is free. If the audit uncovers broader concerns, a Health Check might be a logical next step.
We're booking audits this week. Most can be completed within a few days of you getting in touch.
Yes. The modern Claris Data API, OData and REST have replaced the PHP API almost everywhere. We can help you retire PHP and move to a supported, secure integration layer.