For founders with a prototype
Take your prototype to productionFor teams that need engineers
An engineer in your team while you hireAn extended dev team, month to monthFREE TOOL
Paste the output of php -v, the PHP Version line from phpinfo, or your Docker image tag. The checker compares it with the fixed releases in the PHP advisory for CVE-2026-109618 and CVE-2026-109619.
It runs in your browser. What you paste is not sent anywhere and not stored, and the checker never visits a website, so paste text, not an address.
If your PHP comes from Ubuntu, Debian or another distro
Distributions backport fixes into older version numbers, so a php -v that shows an "old" version doesn't by itself mean you're vulnerable. Examples listed as fixed for both CVEs:
Check the full package version against the Ubuntu or Debian security tracker, or ask your vendor.
Run it on the server over SSH. It shows the command-line PHP, and the web server can run a different one, so confirm with phpinfo too.
Upload a temporary file with a hard-to-guess name containing <?php phpinfo(); and copy the PHP Version line. Delete the file right after: it shows server details to anyone who knows the URL.
The FROM line in your Dockerfile, or the image line in your compose file, for example php:8.2.34-apache.
From the php.net advisory of 21 Oct 2026. As of 24 October 2026 there is no newer PHP release.
| Branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
8.1 and older: no fixed release from the PHP project
Not sure your site runs PHP at all, or which PHP serves it? Start with Am I affected by PHP2Shell?
