Does your website report an affected PHP version?
Check the version advertised by your website against CVE-2026-109618 and CVE-2026-109619. We send one ordinary request. We never send exploit payloads.
A website can hide its PHP version or use a vendor backport. An unknown result is not a pass; a patched banner does not verify every server.
Verify the runtime serving requests. Update to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a vendor-confirmed fixed package, then restart every worker.
Read the PHP security advisoryAlready know your PHP version?
Enter the version from your hosting panel or serving runtime. This comparison runs in your browser. Avoid publishing a phpinfo page.
What this check can and cannot tell you
The URL checker examines response headers. It does not prove exploitability, detect every PHP installation, bypass a CDN, follow redirects or scan other paths. A high-risk version is a reason to verify and patch, not evidence that your site was hacked.
The URL is sent to our Render backend for one request. It is not intentionally logged or stored; an in-memory hostname hash limits repeated checks. Render and GitHub may retain ordinary service access metadata. Do not submit sensitive paths. Version-only input stays in your browser.
Advisory snapshot: 22 October 2026 · Open source · Source and local scanner