PHP Vulnerability Checker
Two critical PHP bugs announced on October 21, 2026 can let attackers take over a web server. Enter your website to see if it's running a vulnerable PHP version, and what to do about it.
Checked , PHP version
Good to know
This is a version check from the outside. It can't see every server your site uses, so if you have other websites or a separate admin area, check those too.
If you also run a WordPress blog, an online store, or another site on a regular web host, check that address too.
Find your PHP version in 2 minutes
WordPress
Log in, then go to Tools → Site Health → Info, and open Server. The PHP version is listed there.
Hosting with cPanel (GoDaddy, Bluehost, HostGator, Namecheap and others)
Log in to cPanel and open MultiPHP Manager or Select PHP Version.
SiteGround
Open Site Tools → Devs → PHP Manager.
Not sure? Ask your web host
Send them the message below. Every host should be able to answer it today.
Then compare your version with the table further down this page.
What to do now
- Switch to a supported PHP version. In your hosting control panel (cPanel's MultiPHP Manager or Select PHP Version, SiteGround's PHP Manager), pick PHP 8.4 or 8.5. Back up your site first, then check that it still works after the switch. Old plugins or themes may need updating too.
- On shared or managed hosting, your host installs the fix. Patch updates like 8.3.35 → 8.3.36 come from your host, not a setting you change. Send them the message below and ask them to confirm.
- Run your own server? Install your system's PHP security updates (for example
sudo apt update && sudo apt upgradeon Ubuntu or Debian), then restart PHP-FPM or Apache so the new version is actually running. - Check again here once it's done.
Message to send your web host or web person
Copy this and send it to your hosting company's support, or whoever manages your website. You can also paste it into ChatGPT or Claude for step-by-step help.
Check that nobody got in already
Attackers move fast once a bug like this is public. After updating, look for:
- Admin users you don't recognize (in WordPress: Users).
- Files changed recently that you didn't change, especially in
wp-content. .phpfiles inside your uploads folder. There shouldn't be any.- Strange redirects, pop-ups, or pages you didn't create.
Run a malware scan (your host often has one, or use a security plugin) and change your hosting, database, and admin passwords.
From the php.net advisory. These reduce exposure, but php.net is clear that only updating actually fixes it.
- Set
session.upload_progress.enabled=0in php.ini, the FPM pool or server config (notini_set()or.user.ini), then restart every PHP worker. - Set
memory_limit=-1where apps can't override it (for examplephp_admin_value), and use a container or cgroup memory limit instead (notRLIMIT_ASorRLIMIT_DATA). - Lower
post_max_size(8M without uploads, 32M with), keepupload_max_filesizebelow it, and cap request size, field count, multipart parts, headers and nesting depth at the web server or proxy. - On PHP 8.5, set
fatal_error_backtraces=0and restart every worker. - Remove per-request settings that trigger warnings, and fix fatal errors and timeouts that visitors can trigger.
What is the PHP vulnerability?
On October 21, 2026, the PHP team released emergency updates for two critical bugs, CVE-2026-109618 and CVE-2026-109619. Both can let an attacker run their own code on a web server without logging in. php.net's advice: update now.
PHP runs WordPress, WooCommerce, Joomla, Drupal, Magento and most shared web hosting. php.net says every PHP installation that serves websites is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on Apache with mod_php, where a working attack has been shown that runs before any of your website's own code.
Which PHP versions are fixed?
| PHP version | Vulnerable | Fixed in |
|---|---|---|
| 8.5 | 8.5.11 and earlier | 8.5.12 |
| 8.4 | 8.4.26 and earlier | 8.4.27 |
| 8.3 | 8.3.35 and earlier | 8.3.36 |
| 8.2 | 8.2.34 and earlier | 8.2.35 |
| 8.1 and older | All versions | No official update (end of life) |
PHP 8.2 stops getting security fixes on December 31, 2026, so if you're updating anyway, 8.4 or 8.5 is the better move. Linux distributions such as Ubuntu and Debian often keep the old version number and add a suffix (like 8.3.6-0ubuntu0.24.04.x) when they ship a fix, so check your distribution's security notice. Source: php.net security advisory.
How this checker works
We visit your homepage the same way a browser does (and your WordPress login page if your site runs WordPress) and read the public information your server sends back. Many servers announce their PHP version in a header called X-Powered-By. We compare that version with the fixed releases above. We never send attack traffic and we don't need a login. If your server hides its version, we'll tell you so and show you how to look it up yourself.
Stop losing calls. Start with Zinng.
Set up your AI phone agent in minutes. Try it free for 7 days.
Try Zinng FreeFrequently Asked Questions
Common questions about the October 2026 PHP security bugs.