Is your website affected by the PHP flaws?
On October 21, 2026, the FBI's Cyber Division warned about two critical flaws in PHP, the code under WordPress and a big share of the web. Type your website below. In a few seconds you will see whether it runs PHP, which version it announces, and exactly what to tell whoever runs it.
Check my site
What happened
Four facts, each with its source.
- 01Two critical flaws in PHP.CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. FBI Cyber Division, October 21, 2026.
- 02They can let a stranger run code on your server.PHP's security advisory: every PHP install that serves web requests is affected.
- 03The only safe fix is an update.php.net, October 21, 2026: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Versions 8.1 and older are end of life.
- 04WordPress runs on PHP.WordPress runs 39.6% of all websites. W3Techs, October 21, 2026.
The fix
One update. Every server.
PHP's own advisory says there is no complete workaround: updating is the only safe choice. Find your branch, then the release it needs.
| Your branch | Fixed in | What to do |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update to 8.5.12 or later. |
| PHP 8.4 | 8.4.27 | Update to 8.4.27 or later. |
| PHP 8.3 | 8.3.36 | Update to 8.3.36 or later. |
| PHP 8.2 | 8.2.35 | Update to 8.2.35 or later. 8.2 itself reaches end of life on December 31, 2026. |
| PHP 8.1 and older | None | End of life. Move to a supported branch. Some hosts apply minimal backported fixes; get it in writing. |
On WordPress?
Read the exact version yourself in two minutes.
- 1Log in to WordPressSign in to your site at yoursite.com/wp-admin.
- 2Open Site HealthIn the left menu, open Tools, then Site Health.
- 3Read the PHP versionOpen the Info tab, expand Server, and read the PHP version.
- 4Compare itPatched releases are 8.5.12, 8.4.27, 8.3.36, 8.2.35. Lower on the same branch, or 8.1 and older, means it needs the update.
Why our sites had nothing to patch
You shouldn't have to know what PHP is.
You should know if ChatGPT knows your name.
We don't build on PHP. We build every page for Google and AI to read, manage the site for you end to end, and check what the AI assistants say about you. A week like this one costs our clients nothing.
Questions
What owners ask us.
Is running this check safe for my website?
Yes. We ask for your homepage once, the same way any visitor's browser does, and read what it sends back. We never touch a login page, an admin page or anything but the address you type.
How can you tell which PHP version my site runs?
Many servers announce it in a header called X-Powered-By, for example "PHP/8.1.34". When yours does, we show you that exact header. When it does not, we look for the things PHP sites leave behind: a WordPress, Drupal or Joomla signature, a PHP session cookie, or links to .php pages on your own domain.
My site says "no sign of PHP." Am I safe?
From these two flaws, probably, but a site can hide what it runs on, so it is not a guarantee. If you are not sure, ask whoever hosts your site what it runs on and get the answer in writing.
My host says they backported the fix. Does that count?
It can. Linux distributions and some hosts apply the fix without changing the version number, and PHP published minimal fixes for 7.4, 8.0 and 8.1. A version number cannot show that, so ask your host to confirm in writing that the fixes for CVE-2026-109618 and CVE-2026-109619 are installed.
My site is on Wix, Squarespace or Shopify. Do I need to do anything?
No. Those platforms run their own servers and you cannot change PHP on them. These two flaws are theirs to handle, not yours.
Cloudflare sits in front of my site. Does that protect me?
It helps. Cloudflare has published stopgap firewall rules for these flaws. They do not replace the update, which PHP's advisory calls the only safe choice.
Do you keep what I check?
We keep the address you checked and what its homepage announced, so the checker can limit how often it runs. Your own IP address is never stored, only a scrambled code made from it.
Why don't your sites run on PHP?
We build on a modern stack with no PHP server for an owner to patch, and we manage every site for our clients, end to end. A week like this one costs them nothing. The time goes where it should: getting found on Google and in AI answers.