Out-of-memory handling errors.
Memory-handling errors may allow an attacker to execute code. An update is required.
IT & WEB · SECURITYVERSION RULES · LOADING
Website & email security check
PHP check.
Keep current vulnerabilities in view.
Check publicly visible PHP version information for current security vulnerabilities. Get clear findings and practical guidance on points that need further investigation.
Start PHP check ↘A check by mol.ruhr · Bochum-LindenFor your website. No exploitation attempts.
PHP SECURITY CHECK ASSESS CURRENT VULNERABILITIES.
PHP vulnerabilities.
What can we see?
Enter your website address. The check looks for public PHP version information and compares it with the security updates for CVE-2026-109618 and CVE-2026-109619. It also compares the automatically retrieved official security releases and support status. Additional editorial guidance covers CVE-2026-115560 and the Windows package update of 26 October 2026.
A first look from outside.
The check sends a normal web request. An HTTP header does not prove which PHP version is actually running. Hidden versions, provider backports, session settings and Windows package versions need to be verified by your hosting provider. No vulnerabilities are exploited.
CHECK PHP SECURITY
NOT CHECKED YET
Can the PHP patch level be identified?
After starting the check, you will see an assessment of the current PHP vulnerabilities and any further checks required.
ADDITIONAL GUIDANCE · 23 OCTOBER
What an external check cannot tell you.
PHP also recommends setting session.upload_progress.enabled=0. This relates to another possible attack path under an unusual combination of session configuration and application code (CVE-2026-115560). An updated PHP version alone does not assess this issue.
Internal PHP settings cannot be retrieved by checking your website URL. Your hosting provider must verify them directly. The change must take effect before request processing. For FPM, set it in php.ini or the pool configuration, then restart all affected workers; ini_set() and FPM.user.ini are not sufficient for this purpose.
ADDITIONAL GUIDANCE · 26 OCTOBER
On Windows, check the package too.
Updated PHP packages 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1 with Brotli 1.2.1 were released for Windows. They fix CVE-2026-111497 in Brotli decompression. The affected decoder can be reached through cURL when automatic HTTP decompression is enabled.
The PHP runtime version remains unchanged by this package update. A version header therefore cannot confirm the fix. For Windows hosting, ask your provider to verify the actual package version.
BACKGROUND CLEAR FACTS. PRACTICAL STEPS.
Two vulnerabilities.
One essential update.
State carried over from earlier requests.
Internal state can persist beyond the lifetime of its data. This vulnerability also requires an update.
Security updates of 21 October 2026
PHP 8.2 8.2.35 or laterPHP 8.3 8.3.36 or laterPHP 8.4 8.4.27 or laterPHP 8.5 8.5.12 or later
For these two CVEs. Newer versions are also compared automatically; the original minimum versions for these CVEs remain unchanged. Verify provider backports separately. PHP 8.1 and earlier no longer receive regular updates from the PHP project.
What does the result mean?
This is an assessment of public version information for the PHP vulnerabilities listed. Internal settings are not retrieved, and the check does not prove that a website is uncompromised. Without access to processes and package management, it cannot confirm that all workers have been restarted or that every domain uses the same handler.
What if no PHP version can be identified?
Many websites hide their PHP version or do not use PHP. The result is then “unable to determine”. This neither identifies a specific PHP vulnerability nor confirms security. Ask your hosting provider for the actual web PHP version and patch level.
What should I do after an update?
Restart all affected PHP workers, verify the actual web version and test the application. Include archived websites and other PHP handlers. WAF rules and pm.max_requests are not a substitute for the security update.
Sources: PHP security announcement of 21 October 2026 ↗ · PHP guidance of 23 and 26 October 2026 ↗
Loading version rules. Editorial CVE guidance: 27 October 2026.
PERSONAL SUPPORT.