On 21 October 2026 PHP released emergency fixes for two unauthenticated remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619). Enter a domain and we’ll read the version banner the site already sends every visitor, and tell you what it shows.
PASSIVE CHECK - WE READ THE HEADERS YOUR SITE ALREADY SENDS EVERY VISITOR
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is unpatched; PHP 8.1 and below are end-of-life and have no official fix. Two caveats: many sites deliberately hide their PHP version (we’ll tell you when we can’t see it), and hosts using Linux distribution packages may show an old version number even after patching — in that case the package changelog, not the banner, is the source of truth. Updating the runtime is also not enough on its own: PHP-FPM or Apache must be restarted.
For the questions to send your web host this week, read our PHP2Shell field note.