Home / Knowledge / PHP Check

Security update · 21 October 2026

Is your website still running the old PHP?

The PHP project has fixed two critical vulnerabilities, now known as «php2shell», both rated 9.2 out of 10. Without the update, an attacker can run their own code on your web server without a password. Almost every WordPress website is affected. Find out in ten seconds what your website reveals.

Free · no sign-up · a single request to your homepage

As of 22 October 2026

Safe from

These versions are fixed.

Safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or newer. PHP 8.1 and older no longer receive a fix from the PHP project, and PHP 8.2 receives no security updates after 31 December 2026.

No password needed

A single crafted request to the web server can be enough. The PHP project rates the risk highest for Apache with mod_php.

Only the update protects

«Updating is the only safe choice», writes php.net. Changed settings lower the risk, but they do not make an installation safe.

Not just the website

The Swiss Federal Office for Cybersecurity advises checking applications and devices that contain PHP as well, such as network storage, intranets or booking systems.

Questions

Frequently asked questions.

How does the check work?

We request the homepage of your website exactly once, just like any browser does, and read the PHP version that many servers include in their response. We do not attack, we do not scan, and we keep the checked address in a cache for 15 minutes only.

Your server does not reveal its PHP version. That is good practice, but it says nothing about whether the update is installed. In WordPress you find the version under Tools › Site Health › Info › Server. Or ask your host.

Yes, in two cases. Some Linux distributions apply fixes without changing the version number. And a different server may sit in front of the one that generates the page. The check is a quick first indication, not a guarantee. What counts is your host’s confirmation.

Nothing. We review your website by hand, tell you what to do and whether your host has installed the update. It only turns into an assignment if you want it to.

That is the name of the two critical vulnerabilities in PHP that the PHP project fixed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10. They let attackers run their own code on a web server without a password.

Sources: php.net, release announcements 8.5.12, 8.4.27, 8.3.36 and 8.2.35 of 21 October 2026 · NSA Advisory: PHP Updates · Background (in German) at Leitgrad. The check is an indication without warranty.

Rather talk directly?

30 minutes with Merag Shahzad: together we look at where your website stands and what your host needs to do.