Web Application Security Assessment & Monitoring

Web Application Security

Service

Find exploitable web risks before they become incidents.

DEHA Global assesses web applications, APIs, source code and supporting infrastructure, pairing automated coverage with expert validation to confirm what is real and rank it by business risk. We stay with the work from there, through remediation guidance, hands-on implementation where your tier includes it, and a verifying retest.

Illustrative sample

ISO 27001 · CMMI Level 3 · PDPA-ready · NDA and controlled data handling · Backed by DEHA Group (Singapore · Vietnam · Japan)

Current security alert, October 2026

Critical PHP security update, October 2026.

Two critical PHP vulnerabilities may allow unauthenticated remote code execution. DEHA Global can help assess exposure, plan and implement the required upgrade where scoped, and verify that affected systems are running on a patched release. If your site runs on PHP, including stores built on common CMS and e-commerce platforms, review your version and your host’s backport status.

Reference

CVE-2026-109618
and CVE-2026-109619

Severity

Rated critical, unauthenticated remote code execution

Affected

Supported PHP 8.2 to 8.5 branches are affected. Vendor-maintained or backported builds should be verified with the hosting provider.

Fixed

PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, 21 October 2026

On managed hosting

The fix is usually applied by upgrading the PHP runtime version in your hosting control panel. Confirm the patched or backported build with your hosting provider before treating the issue as resolved.

/ What attackers test first

The gaps are checked before anything else.

Common web application flaws

The weaknesses that let an attacker read or change data they should not.

What we check

OWASP Top 10:2025-aligned testing, covering injection, access-control, authentication, configuration and component risks, with additional checks such as XSS and CSRF.

Components are a version behind

Run an outdated component and you inherit vulnerabilities already published for it.

What we check

Outdated language, framework, or CMS with published CVEs, checked against known vulnerable versions.

Secrets left reachable

Files that quietly expose credentials or source to anyone who looks.

What we check

Exposed configuration, source-control folders, backups and admin pages.

Weak transport and email setup

Configuration gaps that undermine trust and let mail be spoofed.

What we check

TLS, security headers, DNS and email authentication, SPF, DKIM, DMARC.

/ Choose your assessment

Three tiers. Scoped to what you run.

DEHA Global’s involvement can extend from assessment and remediation guidance to hands-on implementation, patch deployment and verification, depending on the selected tier.

Automated external

Security Health Check

Best for brochure sites and landing pages.

Testing approach: Automated external assessment of public exposure.

Scope note: Expert manual validation and hands-on remediation require a separately agreed scope.

Deliverable: Risk-ranked report with prioritized remediation guidance.

Expert-led

Most chosen

Vulnerability Assessment

Best for business websites, e-commerce platforms and customer portals.

Testing approach: Automated discovery plus expert validation and deeper technical testing.

Scope note: Hands-on remediation and patch deployment are available as a scoped option.

Deliverable: Detailed report, technical review session, and one remediation retest for findings within the original scope.

Ongoing managed

Continuous
Security Monitoring

Best for critical systems, ERP platforms and customer portals.

Testing approach: Recurring assessment, active monitoring and managed remediation for covered systems.

Deliverable: Monthly reporting, new-CVE alerts and a 24/7 Critical response SLA.

Access requirements: Codebase access for source-code review · Server and filesystem access for compromise checks · Tenant access for agreed cloud workloads

Capability

Health Check

Most chosen

Vulnerability Assessment

Continuous Monitoring

Automated external checks

Included

Expert validation and deeper testing

Not included

Included

Source code, infrastructure and compromise review

Not included

Included

Remediation support

Guidance

Guidance + scoped implementation

Guidance + implementation

Ongoing monitoring and new-CVE alerts

Not included

Included

Retest

Not included

One included

Per agreed plan

24/7 Critical response

Not included

Included

/ How testing works safely

Authorized, scoped and reversible.

01 Scope and NDA

NDA first, then we agree the assets, depth and tier that matter.

02 Authorization

Written permission and rules of engagement before any testing.

03 Confirm assets and access

We confirm exactly what is in scope and what access is needed.

04 Test and validate

Automated assessment, with expert validation where included in the selected tier.

05 Review and prioritize

Findings were walked through with your team and ranked by business risk.

06 Remediate where included

DEHA Global implements agreed code, configuration, dependency, or infrastructure changes where remediation is included in the selected tier or statement of work.

07 Retest and close out

We retest the affected findings, confirm they are closed, and hand over the record.

See testing safeguards

Rules of engagement cover

Deliverable: Monthly reporting, new-CVE alerts and a 24/7 Critical response SLA.

Testing is planned to minimize production impact. Intrusive tests require prior approval. Information is handled under NDA and agreed access and data-handling controls.

/ What you receive

What you get, and what it looks like.

Risk-ranked report

All tiers

Findings include available evidence, risk context and recommended remediation, prioritized by severity, exploitability and business impact. Expert validation applies on the relevant tiers.

Remediation review session

VA, Continuous

A working session where we walk your team through the findings and the fixes.

One remediation retest

One retest of findings within the original scope, with the result recorded in the report.

Monthly report and new-CVE alerts

Continuous

A monthly report plus alerts for new CVEs as they affect your stack.

SEC-001

Publicly accessible environment file

Asset

app.sample.example

Severity

Critical

Status

Open

Validation

Manually confirmed

Classification

CWE-538 Security Misconfiguration

Business impact

An unauthenticated attacker may retrieve application configuration and exposed credentials, potentially enabling unauthorized access to connected systems.

Evidence

Redacted response demonstrating the configuration file was publicly retrievable.

Remediation

Block access to dotfiles at the web-server layer, remove the file from the deployment artifact, rotate exposed credentials, and review access logs.

Retest

Pending

Fictional sample finding.

/ Service commitments

What we commit to.

Continuous Monitoring

24/7 Critical response

For covered Critical alerts under Continuous Security Monitoring, DEHA Global provides 24/7 acknowledgement and initial triage within four hours.

Continuous Monitoring

Hands-on remediation

DEHA Global engineers implement and deploy patches for covered systems under Continuous Security Monitoring. This is available as a scoped option with Vulnerability Assessment.

Vulnerability Assessment

Verification retest

Vulnerability Assessment includes one retest for findings within the original scope. Continuous Monitoring retesting follows the agreed service plan.

The four-hour commitment covers acknowledgement and initial triage, not guaranteed remediation or resolution. Remediation timing depends on the vulnerability, system condition, vendor patch availability, required access, testing and customer approval. A resolution SLA applies only where explicitly defined in the contract.

/ Request a security assessment

Tell us the shape of it.

A DEHA Global engineer replies to scope your assessment. No sensitive details needed here, we agree access and credentials under NDA.

Not ready to scope yet? Start with the service overview.

It covers the three assessment tiers and what each one includes, how we scope and run testing, what you receive, typical timelines and the factors that shape a quote.

/ Pricing factors

No list price. Scoped to your site.

Pricing depends on the number of applications and domains, authentication depth, source-code and infrastructure access, optional remediation work, testing constraints and whether the engagement is one-off or continuous.

/ FAQ

The questions that decide
whether this gets approved.

Will testing disrupt my live site?

Testing is planned to minimize production impact. Intrusive tests require prior approval and are run against staging or an agreed-upon window, where needed.

Can DEHA Global fix the vulnerabilities it finds?

Yes. For Vulnerability Assessments, hands-on remediation and patch deployment can be included within the agreed scope. Continuous Security Monitoring includes remediation and patch deployment for covered systems. Changes follow agreed access, approval, testing and rollback procedures.

What access will DEHA Global need?

External checks may only require the agreed public assets. Source-code review requires access to the agreed codebase; compromise checks require authorized server and filesystem access; cloud configuration review requires access to the agreed cloud tenant and workloads.

Do you sign an NDA?

Yes, before receiving system access, credentials, or sensitive technical information. Initial commercial scoping can be completed without sensitive data. We handle information under an NDA and have agreed access and data-handling controls.

Which stacks and clouds do you cover?

Web applications, REST and GraphQL APIs, web servers, databases, containers, and cloud on AWS, Azure and GCP. Dependency review covers common package ecosystems.

What is included in the report?

Each confirmed finding comes with evidence, risk context and recommended remediation, prioritized by severity, exploitability and business impact.

How fast do you respond, and how long does a retest take?

On Continuous Security Monitoring, DEHA Global provides 24/7 acknowledgement and initial triage within four hours for covered Critical alerts. This does not guarantee resolution within four hours. A focused retest typically takes one working day, depending on the number of findings, system size and extent of the changes.

What does it cost?

There is no list price. The work depends on scope, so we quote per site across the three tiers.

See where you stand before an attacker does.

Request a security assessment and a DEHA Global engineer will scope it with you, or get the service overview to brief your team first.

Oriene AI