FREE CHECK
Is your website exposed to the October 2026 PHP vulnerabilities?
On 21 October 2026 CERT-AGID flagged new PHP vulnerabilities. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; anything older than 8.2 gets no fixes at all. Enter your site address: I look at which PHP version the server declares and tell you what it means.
Why the header is not enough
Many servers hide the PHP version: it is a good practice, and it means the check cannot conclude anything. Hosting providers also often put a proxy or a CDN in front, which removes these headers.
Linux distributions (Debian, Ubuntu, Red Hat) backport fixes into their own packages: a version like 8.2.7-1~deb12u1 may already be fixed even if the number is old. Only the package changelog says.
A header can say one thing while the server runs another: it is information, not proof. That is why the result never says "safe".
Source: CERT-AGID, bulletin of 21 October 2026, and PHP supported versions.
Questions
Is this check legal? Does it attack my site?
It makes one ordinary request to the home page, the same a browser makes, and reads only two headers. It does not try any vulnerability. Still, only check sites you manage.
Do you keep the addresses I check?
No. The address is used for the request and then discarded; it is not written to logs or databases. It reaches me only if you fill in the form below the result.
My hosting is managed: do I have to do anything?
Ask the provider which PHP version your plan uses and when they apply the October fixes. On many shared hosting plans you choose the PHP version from the control panel.
Intro call · 30 minutes · free
Want to go through it together? Thirty minutes, free.
or write to info@gabrielepieretti.dev · I reply the same day