Mark sites reporting a PHP release without the php2shell fixes (CVE-2026-109618/-109619; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12) or an end-of-life branch (8.1 and older). The overview gets a counter tile that doubles as a filter, a status pill per row and PHP in the search; the detail page explains that the hoster has to update. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>