Frequently asked questions
Which PHP versions are affected?
Every version before 8.5.12, 8.4.27, 8.3.36 and 8.2.35 in the supported branches. PHP 8.1 and older are end of life and receive no release from the PHP project; treat them as affected unless your vendor confirms a backported fix.
My site does not show a PHP version. Am I safe?
Not necessarily. Hiding the version (expose_php = Off) is good practice but does not patch anything. Check on the server with php -v or ask your provider.
The checker shows an old version, but my host says it is patched. Who is right?
Possibly both. Linux distributions such as Debian, Ubuntu and RHEL often backport security fixes without changing the version number. Ask your host which package build is installed and whether its changelog mentions CVE-2026-109618 and CVE-2026-109619.
Is WordPress, Laravel or my CMS affected?
The flaws are in PHP itself, so any application running on an affected PHP is exposed. The researchers demonstrated unauthenticated attacks on WordPress, Drupal and Joomla, but those were only examples — even a plain “Hello World” page is enough. Updating WordPress or plugins does not fix it; PHP must be updated.
Can data leak even if no code was executed?
Yes. CVE-2026-109619 can disclose PHP process memory — passwords, session tokens, API keys and certificates from other requests — without the attacker running code. Such leaks leave no files behind and are hard to detect, so change the secrets of any site that ran an affected version on the internet.
Does turning off session.upload_progress fix it?
No. php.net lists session.upload_progress.enabled=0 as a partial mitigation for some confirmed paths of CVE-2026-109619. It does not cover all variants and does nothing for CVE-2026-109618.
Is a web application firewall enough?
A WAF or request limits can reduce exposure while you update, but the issues are in how PHP handles requests and memory. Updating is still required.
Do I need to restart anything after updating?
Yes. PHP-FPM, Apache, LiteSpeed and long-running workers keep running the old code until they are restarted. Containers must be recreated from the new image.
What does this checker actually do?
It sends one HEAD request (or a GET if HEAD is not allowed) to the address you enter, follows up to three redirects, and reads response headers such as X-Powered-By and Server. It never sends exploit payloads, large requests or uploads, and it does not scan other paths.
Is it legal to check any website?
Only check sites you own or are authorised to assess. The request is the same as a normal visit, but responsible use is your responsibility. We limit checks per network and per site.
Was PHP 8.5.12 fixed completely?
Reports of a crash in 8.5.12 circulated on 22 October 2026, but they were not confirmed as a remote vulnerability. We follow php.net; if a new release appears, this site will be updated and the “last verified” date will change.
Where can I read the official details?
On php.net and in the PHP project’s GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. The research team (Wiz Research, OpenAI Codex Security and Calif) published its findings at php2shell.com.
Who found the vulnerabilities?
Researchers from Wiz Research, OpenAI Codex Security and Calif, through coordinated disclosure with the PHP security team, which prepared the fixes. See the PHP Foundation’s post on the release.