← KeyLeak

Check a website’s reported PHP version

Assess CVE-2026-109618 and CVE-2026-109619 using ordinary response headers. This check cannot prove whether a website is vulnerable or safe.

One public URL. No query strings, credentials, redirects, or exploit payloads. Hidden versions and vendor builds require further verification.
{% if error %}{% endif %} {% if result %}

{{ {'potentially_affected': 'Potentially affected', 'patched_version_reported': 'Patched version reported', 'unknown': 'Patch status unknown'}[result.status] }}

{% if result.version %}

Advertised PHP version: {{ result.version }}

{% endif %}

{{ result.reason }}

Verify the PHP runtime serving the site and every worker. Apply PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a vendor-confirmed backport, then restart workers.

Read the PHP security advisory
{% endif %}

Local assessment · Advisory snapshot: 22 October 2026 · No exploit testing