Is your website affected?
On 21 October 2026 the PHP project released security versions against two critical flaws. This check looks at your website's home page from the outside and tells you in plain words what is fine and what is left to do.
Check
Care package
If you would rather not deal with your host, updates and certificate yourself, I take care of it. I go through the yellow and red points with you, sort them out with your host and check afterwards that everything works.
Price: on request. We agree scope and price once I have read your request. Sending it does not order anything.
Background
On 21 October 2026 the PHP project released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. They close two flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run code remotely. CERT-EU rates them as critical and advises updating immediately. Websites whose server uses an older PHP version can be affected – for example with WordPress or Joomla.
Whether your site is patched can only be seen from outside if the server shows its PHP version. Many hosts hide it – which is good, but then only asking your host helps. The check also shows who issued your certificate and when it expires.
Sources: php.net · CERT-EU, Security Advisory 2026-018
What is checked – and what is not
- One request to
http://(only: does it redirect to https?) and one request tohttps://for the home page, at most three redirects, at most 8 seconds. - Evaluated: certificate (valid, expiry, issuer), HSTS, server banner, visible PHP version and the generator tag of WordPress, Joomla and similar software.
- Not checked: subpages, plugins, passwords, open ports. A green result does not mean a site is secure – only that nothing conspicuous is visible from outside.
- Please only check websites that you own or look after. At most 10 checks per hour per address are possible.
- Privacy: the checked address is neither stored nor logged. I only have it if you request the care package. Details in the privacy policy.