Free tool · Critical PHP release, October 2026

Know which PHP sites to patch first.

The emergency PHP release fixes two unauthenticated remote code execution flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). You can’t patch everything at once. Paste your web domains: we read the live PHP version of each site, flag the ones below the fix and rank them by priority, so your team starts where the risk is real.

The real versionRead live from each site, not guessed from a banner database.

Ranked by priorityVulnerable and directly exposed sites first, patched sites last.

Non-intrusiveOne standard request per host. No exploit, no vulnerability test.

Check your domains

Domains or hosts, one per line Up to 500 hosts per run.

No host yet.

Results

4/4 Critical

Below the fix, no WAF. Patch now.

3/4 Major

Below the fix, behind a WAF.

Patched

Not exposed to these CVEs.

Not disclosed

Version hidden, cannot assess.

Priority	Host	PHP	Branch	Support	WAF / CDN	Server

How we rank. 4/4 Critical: PHP below the fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35) or end of life, and no WAF visible. 3/4 Major: below the fix, behind a WAF. Patched: not exposed to these CVEs. Not disclosed: the server hides its version, so we cannot assess it.

What this check does not tell you. Most servers hide their PHP version: a blank version means not disclosed, not no PHP. No WAF visible is not proof there is none. We read the public home page only and test no vulnerability.

Share this with your team

Generate a CISO-ready PDF report of these results, in your language, in seconds.

This list covers the domains you know about.

Attackers scan the ones you forgot. Attack Surface Management maps and monitors your full external exposure, including shadow IT and unmanaged sites, and tells you what to fix first.

See your full attack surface Read the PHP advisory