Check your website’s PHP patch level.
- CVE-2026-109618 – official security advisory (opens in a new tab)
- CVE-2026-109619 – official security advisory (opens in a new tab)
Reference data: expert-reviewed on October 21, 2026 · data version 2026-10-21.1
PHP check
- Check
- Confirm
- Fix
- Done
Or: ·
Step 2: Confirm the real PHP version
A small verification file on your web space reads out which PHP version your website really uses. It takes about two minutes and also works if your website hides its version.
This check assesses version hints. A missing hint does not mean the website is secure. A possible compromise is not examined here.
No check started yet.
In three steps
How it works
Enter an address
Enter a public website address – or enter your PHP version directly.
Compare version hints
Publicly visible information is compared with the reviewed reference data for each PHP branch.
Understand the next step
You get an assessment for both CVEs, the limits of what it tells you and matching step-by-step help.
What the check tells you – and what it doesn’t
The external check only fetches the address you enter (HEAD, and if needed a GET that is aborted immediately, at most three redirects) and reads headers such as X-Powered-By. It does not run any third-party JavaScript, sends no attack requests and does not crawl any other pages.
- Assessment for CVE-2026-109618 and CVE-2026-109619
- Same rules for the external check, verification file and manual input
- No check for compromise or malware
- No proof of actual exploitability
- No port scans and no automatic repairs
Frequently asked questions
What does PHP Checker check?
PHP Checker assesses PHP version hints for exactly two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. For the external check, the service fetches the address you enter once and reads suitable response headers (X-Powered-By, Server). Alternatively, you can enter a version or package string yourself, or confirm the real version with a verification file. All methods use the same assessment rules.
Can the check tell whether my website has been compromised?
No. The service does not check for compromise and does not inspect any server files. That’s why the result always says “Compromise: not checked”. If you suspect an attack, have the server examined by professionals – a later update does not remove malware that has already been planted.
Why can’t my PHP version be detected?
Many websites or upstream services (proxy, CDN, protection system) hide version information. This is common and not a security problem in itself. But it doesn’t allow any security verdict either. You don’t need to make version information public: use the verification file or check the active PHP version in your hosting panel.
Does a matching version hint mean my whole website is secure?
No. A version hint only relates to the versions considered and these two CVEs. It is not verified, does not confirm the package actually installed or all running PHP processes, and rules out neither other risks nor an earlier compromise.
What should I do if I’m on an older version?
Check the package version actually in use with your hosting provider or administrator. Have a confirmed update installed, restart the affected PHP processes (e.g. PHP-FPM, Apache) and check the running version again afterwards. If you suspect an earlier attack, the server should also be examined.
Questions about your result?
Do you have questions about PHP Checker or would you like to discuss a result? Contact Denkcode.