What happened
PHP, the software behind many websites, had two dangerous holes. Sites that have not updated can be taken over.
Free PHP safety check
Is this website safe to leave online?
On 21 October 2026, PHP had two serious holes. A stranger could run programs on the server. Paste the website address. We only look at the PHP version. We do not attack the site or change it.
What this page does
It reads the PHP version the site shows. It does not log in, upload a file, or change anything.
Safe versions
8.2.35, 8.3.36, 8.4.27, or 8.5.12. Older PHP should be upgraded.
Versions that include the fix
If your number is the same or lower than the “still unsafe” column, update it. PHP 8.1 and older have no official fix. Move to a newer line.
| PHP line | Still unsafe | Update to |
|---|---|---|
| 8.2 | 8.2.34 | 8.2.35 |
| 8.3 | 8.3.35 | 8.3.36 |
| 8.4 | 8.4.26 | 8.4.27 |
| 8.5 | 8.5.11 | 8.5.12 |
| 8.1 and older | All of them | Upgrade |
Some hosts fix the problem but keep the old version number. Ask them if CVE-2026-109618 is installed. PHP 8.2 support ends on 31 December 2026.
Cannot update today?
These settings only reduce the risk. They do not make the site safe. Restart PHP after you change them. Updating is still required.
- Turn off upload progress. In php.ini set session.upload_progress.enabled=0, then restart PHP.
- On PHP 8.5 only. Set fatal_error_backtraces=0, then restart PHP.
- Limit how much can be posted. Keep post_max_size small, about 8M if the site has no file uploads, or 32M if it does.
How the check works
- We open the address and read the PHP version it sends back.
- We do not download the page or try the security hole.
- If the site hides its version, the result is “Not sure”. That is not a pass.
Want ITCAT MEDIA to fix it?
We build and look after websites. Send us the address and we will update PHP, or tell you if a host patch is already enough.