PCI DSS scan issue

[m.traeumner (Michael Träumner)]

Hi Paul,
welcome to the community. I would try to help you, but can you please explain what you are doing?

Perhaps @bwdjames could help here.
Here is a link to another thread where the security of PCI DSS is discussed.

PHP 7.2 or higher for PCI DSS compliance

That’s the key word - alleged. If the scans cannot tell which versions of the software is being used, then they cannot tell if there are any vulnerabilities. Even if they do know, the scans do not also say if the mitigation or patches for those vulnerabilities are in place. I would say the best move would be the following (and I am not totally a massive fan of security through obscurity): Block any and all ports that are not required, even for the provider’s remote site. If the provider d…