Check Your Website for PHP Vulnerabilities
This tool checks publicly observable indicators, such as disclosed PHP version banners, for CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws fixed on 21 October 2026. It sends ordinary requests only: no exploits, no probing, no login.
Vulnerabilities checked
CVE-2026-109618
✓ Verified advisoryRCE via OOM corruption
PHP uses longjmp() to abort a request on out-of-memory errors. If this happens while request memory is only partly initialized, shutdown code can process invalid state, which can lead to unauthenticated remote code execution.
- Severity:
- Critical · CVSS 4.0 9.2
- Fixed in:
- 8.2.35, 8.3.36, 8.4.27, 8.5.12
- Verified on:
CVE-2026-109619
✓ Verified advisoryRCE via stale global state
Some PHP global state can keep pointing into request memory after that memory is freed. A later request handled by the same worker can act on this stale state, which can lead to unauthenticated remote code execution (use-after-free).
- Severity:
- Critical · CVSS 4.0 9.2
- Fixed in:
- 8.2.35, 8.3.36, 8.4.27, 8.5.12
- Verified on:
What the scanner can and cannot determine
It can
- Read a PHP version that your site discloses publicly (e.g. the X-Powered-By header) and compare it with the official affected ranges.
- Notice signs that PHP is in use even when the version is hidden.
- Explain each result and give remediation steps based on the official advisories.
It cannot
- Prove a site is safe. “No indicators detected” is not a clean bill of health.
- See your PHP configuration, SAPI, or whether your Linux distribution backported the fix.
- Confirm exploitability. It never sends exploit payloads, so banner matches are reported as “potentially vulnerable”.
- Assess a site whose version is hidden. Hiding the version does not make it secure; check on the server.
Security and privacy
- No account, email address or personal information is required.
- Submitted URLs and scan results are not stored. Operational logs record only a random scan ID, the result category and timings, never the URL.
- Each scan makes a small, bounded number of ordinary GET requests with fixed headers. You cannot add headers or change what is sent.
- Private, internal, loopback, link-local and cloud-metadata addresses are blocked, including through DNS tricks and redirects.
- Scans are rate-limited to prevent abuse. Only scan websites you own or are authorized to assess.