FAQ
Frequently asked questions
Short answers about features, results and data processing.
What does PHP Checker check?
PHP Checker assesses PHP version hints for exactly two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. For the external check, the service fetches the address you enter once and reads suitable response headers (X-Powered-By, Server). Alternatively, you can enter a version or package string yourself, or confirm the real version with a verification file. All methods use the same assessment rules.
Which two vulnerabilities does the check cover?
CVE-2026-109618 (code execution after an out-of-memory abort) and CVE-2026-109619 (code execution via stale global state in worker processes). According to the PHP project, both are fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You’ll find details and sources under PHP vulnerabilities.
Can the check tell whether my website has been compromised?
No. The service does not check for compromise and does not inspect any server files. That’s why the result always says “Compromise: not checked”. If you suspect an attack, have the server examined by professionals – a later update does not remove malware that has already been planted.
Why can’t my PHP version be detected?
Many websites or upstream services (proxy, CDN, protection system) hide version information. This is common and not a security problem in itself. But it doesn’t allow any security verdict either. You don’t need to make version information public: use the verification file or check the active PHP version in your hosting panel.
Does a matching version hint mean my whole website is secure?
No. A version hint only relates to the versions considered and these two CVEs. It is not verified, does not confirm the package actually installed or all running PHP processes, and rules out neither other risks nor an earlier compromise.
What are vendor backports?
Linux distributions and hosting providers often apply security fixes to older package versions without raising the PHP version number – recognisable by a vendor revision such as “8.3.6-0ubuntu0.24.04.5”. What counts then is the vendor’s security advisory for exactly this package version and both CVEs. Without that evidence, the result is “Vendor check required”.
Why can the PHP version in the terminal differ?
Web servers, PHP-FPM pools, containers and the command line can use different PHP runtimes. php -v only shows the command-line version. The most meaningful version is the one your website actually runs – and that’s exactly what the verification file shows.
What should I do if I’m on an older version?
Check the package version actually in use with your hosting provider or administrator. Have a confirmed update installed, restart the affected PHP processes (e.g. PHP-FPM, Apache) and check the running version again afterwards. If you suspect an earlier attack, the server should also be examined.
What data is processed for the check?
For the external check, your browser sends the address you entered to our server. Our server queries DNS and fetches the address once; the target website sees our server’s IP address, not yours. The result is only returned to your browser. To prevent abuse, we briefly store a pseudonymised key of your IP address. The manual assessment runs entirely in your browser. You’ll find details in the privacy policy.
Your question isn’t listed? Contact Denkcode.