Check your website’s PHP patch level.
- CVE-2026-109618 – official security advisory (opens in a new tab)
- CVE-2026-109619 – official security advisory (opens in a new tab)
Reference data: expert-reviewed on October 21, 2026 · data version 2026-10-21.1
PHP check
- Check
- Confirm
- Fix
- Done
Or: ·
Step 2: Confirm the real PHP version
A small verification file on your web space reads out which PHP version your website really uses. It takes about two minutes and also works if your website hides its version.
This check assesses version hints. A missing hint does not mean the website is secure. A possible compromise is not examined here.
No check started yet.
In three steps
How it works
Enter an address
Enter a public website address – or enter your PHP version directly.
Compare version hints
Publicly visible information is compared with the reviewed reference data for each PHP branch.
Understand the next step
You get an assessment for both CVEs, the limits of what it tells you and matching step-by-step help.
What the check tells you – and what it doesn’t
The external check only fetches the address you enter (HEAD, and if needed a GET that is aborted immediately, at most three redirects) and reads headers such as X-Powered-By. It does not run any third-party JavaScript, sends no attack requests and does not crawl any other pages.
- Assessment for CVE-2026-109618 and CVE-2026-109619
- Same rules for the external check, verification file and manual input
- No check for compromise or malware
- No proof of actual exploitability
- No port scans and no automatic repairs
Background knowledge
What is PHP?
PHP is the server-side programming language powering more than 75% of all websites worldwide – including WordPress, TYPO3, Joomla, Drupal, and online shops like WooCommerce and Shopware.
How PHP works
When a visitor opens your website, the web server executes the PHP code behind the scenes. It handles database queries, logins, or forms, builds the web page, and serves the finished HTML to the browser.
Why the version matters
Each major PHP version receives security updates for about three years. Outdated versions no longer receive bug fixes – leaving known vulnerabilities like CVE-2026-109618 and CVE-2026-109619 open to attack.
Benefits of modern PHP
Modern versions (such as PHP 8.2, 8.3, and 8.4) not only close security vulnerabilities, but are also noticeably faster, consume fewer server resources, and improve page load times for your visitors.
Frequently asked questions
What does PHP Checker check?
PHP Checker assesses PHP version hints for exactly two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. For the external check, the service fetches the address you enter once and reads suitable response headers (X-Powered-By, Server). Alternatively, you can enter a version or package string yourself, or confirm the real version with a verification file. All methods use the same assessment rules.
Can the check tell whether my website has been compromised?
No. The service does not check for compromise and does not inspect any server files. That’s why the result always says “Compromise: not checked”. If you suspect an attack, have the server examined by professionals – a later update does not remove malware that has already been planted.
Why can’t my PHP version be detected?
Many websites or upstream services (proxy, CDN, protection system) hide version information. This is common and not a security problem in itself. But it doesn’t allow any security verdict either. You don’t need to make version information public: use the verification file or check the active PHP version in your hosting panel.
Does a matching version hint mean my whole website is secure?
No. A version hint only relates to the versions considered and these two CVEs. It is not verified, does not confirm the package actually installed or all running PHP processes, and rules out neither other risks nor an earlier compromise.
What should I do if I’m on an older version?
Check the package version actually in use with your hosting provider or administrator. Have a confirmed update installed, restart the affected PHP processes (e.g. PHP-FPM, Apache) and check the running version again afterwards. If you suspect an earlier attack, the server should also be examined.
What is PHP?
PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely used server-side scripting language. It powers more than 75% of all dynamic websites worldwide – including WordPress, TYPO3, Joomla, Drupal, and many online stores.
PHP processes requests on the web server and generates the web page displayed in the visitor's browser. Because PHP runs directly on the server, keeping it up to date and patched is crucial to prevent security risks such as arbitrary code execution or data exposure.
Questions about your result?
Do you have questions about PHP Checker or would you like to discuss a result? Contact Denkcode.