Does your site run on a safe PHP version?
PHP, the programming language under WordPress, has two critical vulnerabilities, and the first attacks have already been seen. Enter your address to see which PHP version your site uses, whether it runs on WordPress and what to do today.
We only read what your page shows every visitor. We do not store the address.
What is going on?
PHP, the programming language that WordPress and many other websites run on, has two critical vulnerabilities. Through them, an attacker can take over a server remotely without logging in. PHP rates both 9.2 out of 10 for severity.
The details were meant to stay secret until the update was ready, and leaked anyway. Cloudflare saw the first attacks come in on the morning of 21 October.
On 21 October PHP released an emergency update for the versions it still supports: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to PHP there is no complete workaround, and updating is the only safe choice. No official fix is coming for PHP 8.1 and older, says security firm Sansec.
For a WordPress site, an emergency update like this is nothing unusual. The site depends on PHP, on WordPress itself and on every plugin ever installed, and all of those parts need to be kept up to date.
What to do today
- Step 1
Have PHP updated
Ask your hosting company or web developer to install the emergency update today. That is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your version.
- Step 2
Check your PHP version
Does your site run on PHP 8.1 or older? No fix is coming for it. Move to PHP 8.3 or newer.
- Step 3
Not possible right away?
CERT‑EU, the cybersecurity service of the EU institutions, then advises taking the site offline for the time being.
Which versions still get updates
The emergency update is out for every version PHP still supports. Source: php.net, checked on 21 October 2026.
| Version | Status | Security updates until |
|---|---|---|
| PHP 8.5 | Full support | 31 December 2029 |
| PHP 8.4 | Full support | 31 December 2028 |
| PHP 8.3 | Security updates only | 31 December 2027 |
| PHP 8.2 | Security updates only | 31 December 2026 |
| PHP 8.1 and older | No more updates | Expired |
How the check works
-
What the check reads
The headers and the HTML of the page you enter. If the site runs on WordPress and we cannot see the PHP version, we also request /wp‑json/, the public address of the WordPress API.
-
Why the version is often missing
Many hosting companies hide the PHP version, and caches often strip it. That is normal. Only your hosting company or web developer can tell you for certain.
-
What the check does not do
We do not look for vulnerabilities, do not log in anywhere and do not store the address you enter.
Rather have a site without PHP?
We build websites that run without a PHP server. A vulnerability like this does not affect those sites, there are no plugins to keep up to date and you edit the texts yourself. They are also set up to be found in Google and in AI assistants such as ChatGPT.
Frequently asked questions
How do I see which PHP version my website uses?
Enter your address at the top of this page. If your server shows the version, it is in the result. If it is not visible, your hosting company knows. The version is often also shown in the control panel of your hosting plan.
Is my site safe if the check finds no version?
You do not know yet. The check only sees what your page shows publicly, and a hidden version can still be old. Ask your hosting company or web developer.
Which PHP versions have the emergency update?
The emergency update came out as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your server runs PHP 8.3, for example, you need 8.3.36 or newer. According to security firm Sansec, no official fix is coming for PHP 8.1 and older. Those versions no longer get updates.
Which vulnerabilities is this about?
CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell. PHP rates both 9.2 out of 10 for severity. More background (in Dutch) at IO+.
What do you do with the address I enter?
We fetch the page once for the check and do not store the address. If you ask for the free review, our team gets your details and the result of the check.
Can AI Heroes replace my website?
Yes. We build websites that run without a PHP server, with no plugins to keep up to date. You edit the texts yourself, and the site is set up to be found in Google and in AI assistants such as ChatGPT. Ask for the free review and we will look at what your site needs.
Ask for the free review
Leave the address of your site. We look at the technology, the maintenance and how well the site is found in Google and AI assistants. You hear from us within 24 hours.
