PHP Vulnerability Checker
Passively inspect any public website for exposed PHP version headers and signatures following the October 21, 2026 emergency RCE disclosures (CVSS 9.2). Completely non-invasive: sends a single standard GET request with strict rate limits and zero exploit payloads.
Important Non-Definitive Security Disclaimer
This tool performs a non-invasive, passive indicator check based exclusively on publicly exposed HTTP response headers, cookies, and page markup. It is NOT an active penetration test, exploit assessment, or vulnerability scanner. It sends one standard HTTP GET request with a clear User-Agent and never attempts exploitation.
Many hardened servers intentionally suppress or alter the X-Powered-By header (via expose_php = Off), meaning an unpatched PHP version may exist even if no indicators are detected. Conversely, reverse proxies or CDN caching layers may broadcast cached headers. Only your hosting provider or system administrator can authoritatively verify your true internal PHP binary build.
Official security bulletins, CVE descriptions, and source tarballs are published on php.net .
Security Baseline
Official October 21, 2026 Patch Matrix
| PHP Branch | Minimum Patched Release | Vulnerability Status (Oct 2026) | Recommended Action |
|---|---|---|---|
| PHP 8.3 | 8.3.13 or newer | Patched on Oct 21, 2026 | Upgrade any 8.3.x build below 8.3.13 |
| PHP 8.2 | 8.2.25 or newer | Patched on Oct 21, 2026 | Upgrade any 8.2.x build below 8.2.25 |
| PHP 8.1 | 8.1.30 or newer | Patched on Oct 21, 2026 | Upgrade any 8.1.x build below 8.1.30 |
| PHP 8.0 & Older (7.4, 7.3, 5.6) | None (End of Life) | Unpatched / Vulnerable | Mandatory upgrade to a supported PHP 8.1+ release |
Frequently Asked Questions
Does a "No PHP indicators found" result mean my website is safe?
No. We explicitly never state that a site is "safe". Modern security configurations (such as setting expose_php = Off in php.ini or placing an origin server behind Cloudflare) actively hide or strip version headers. Your server may still be running an unpatched PHP engine. You must confirm your internal build version via your hosting panel or CLI.
How does this tool check for PHP without exploiting vulnerabilities?
This tool operates exclusively as a passive auditor. It sends one standard HTTP GET request with a descriptive User-Agent header, exactly like a search engine bot. It examines standard public HTTP response headers (X-Powered-By, Server), cookies (PHPSESSID), and HTML generator tags. It never transmits attack payloads, probes protected endpoints, or performs port scans.
Why is my site showing "Possibly affected" when I use a security plugin?
Application-level security plugins (like Wordfence for WordPress) execute inside the PHP interpreter. The October 21, 2026 vulnerabilities (CVE-2026-109618 & CVE-2026-109619) exist in the core C runtime binary itself. Because the vulnerability triggers before WordPress plugins or authentication hooks execute, you must update the underlying PHP binary on your web server.
What should I do if my site is flagged as "Possibly affected"?
Follow our step-by-step PHP Version Update Guide. If you are on shared hosting, select the latest patched build in cPanel or contact support. If you manage a VPS or cloud server, run sudo apt update && sudo apt install --only-upgrade php (or your distribution equivalent) and reload your web server.
What are the official patched version numbers for CVE-2026-109618 and CVE-2026-109619?
According to the official PHP security announcement on October 21, 2026, the minimum fixed versions are PHP 8.3.13, PHP 8.2.25, and PHP 8.1.30. Older branches (PHP 8.0, 7.4, 7.3, 5.6) are End-of-Life and do not receive official security updates.
Remediation & Advisory Documentation
Read our comprehensive guides for step-by-step update procedures and risk audits: