Current security advisories, clear context and direct checks. The initial focus: PHP2Shell and the two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
PHP released security updates on 21 October 2026. Check the PHP package version actually running — including for WordPress, Drupal and Laravel.
Enter a website. Compare visible PHP indicators with the patch levels for CVE-2026-109618 and CVE-2026-109619.
CVE-2026-109618 · RCE via OOM corruption
CVE-2026-109619 · RCE via stale global state
Context, affected version ranges and concrete steps for your PHP website.
Read the security briefing ↗CVE-2026-115560 · additional PHP advisory
Why the two PHP2Shell updates do not provide a general all-clear on their own.
Read the additional advisory ↗No advisory matches this search. Please try another term.
No. Public headers may reveal a PHP version, but they may also be hidden, outdated or modified. The check provides a version indicator, not proof of exploitation or safety. A missing PHP header is not an all-clear.
If the application uses PHP, the operator needs to check the PHP runtime regardless of the CMS or framework version. The exact PHP version is often available in the hosting panel. Your provider can confirm the actual security patch level.
No. The installed build and all instances actually running are what matter. Some providers ship backports under older version numbers. The additional CVE-2026-115560 advisory also requires a separate configuration check.
No. The domain check retrieves only public HTTP headers from the home page. No exploit payloads, uploads, logins or port scans. You must still check only websites that you operate or are authorised to assess.
HANECS helps you classify technical risks and build defensible evidence. For connected products, continue with the ReguFrame QuickCheck for the CRA and EU AI Act.
Discuss the finding ↗ CRA / AI Act QuickCheck ↗