Free check · No sign-up
Check your website for the new PHP vulnerability.
On 21 October 2026 the PHP project fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let anyone run their own code on a web server without signing in. Enter your domain and our free scan checks the PHP version your website announces against the fix.
Two flaws in PHP itself let a stranger run code on the server.
PHP is the programming language many websites are built in, WordPress among them. Both flaws are in PHP, not in a plugin or a theme, and the PHP project rates both critical, 9.2 out of 10. Someone who can reach the website can use them without an account.
The fix is a PHP update. Hiding the version number from visitors does not fix anything. Read the PHP project’s advisory.
The first release with the fix
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | No official fix |
Some Linux distributions and hosting companies patch older versions themselves. Ask whoever hosts the site.
We read what your website says about itself, and tell you what that means.
PHP vulnerability
The site announces a PHP version from before the fix, or one the PHP project no longer fixes. Unless the host has patched it in place, it is probably open to both flaws.
Possible PHP vulnerability
The site runs a Linux distribution's build of PHP, which may already be patched under the same version number, or it runs PHP without showing which version. We tell you exactly what to check.
Has the fix
Every PHP version the site announces is at or after the fixed release.
No sign of PHP
Nothing on the home page shows PHP. That is not the same as safe: a blog, a shop or another page on the domain could still run it.
The scan looks at your home page the way a browser does. It never tries either flaw against your server: confirming one that way would mean attacking it. The same scan also checks your mail security, domain registration and what your company exposes to the internet.
The free scan reads published information only — the same records a browser or mail server looks up in normal operation. No port scanning, no sign-in attempts, and it’s rate-limited per visitor and per domain. Scan domains you own or administer.
It runs without an email address; the first two findings are shown either way and the rest need one. We’ll email a copy when the address is at the domain that was scanned — we don’t send reports about one company to someone at another — and we may follow up about Tenant Strike. Unsubscribe in one click from anything we send.