Check the source.
Keep the uncertainty.
This independent tool translates your self-reported patch information into evidence to collect. It does not test vulnerabilities or authenticate what you enter.
Primary references
- PHP project's security announcement and stable releases, 21 October 2026 — fixed upstream versions, affected Web runtimes, older-branch source backports and 8.6 RC4 testing warning.
- PHP Foundation, 21 October 2026 — background and technical scope of both issues.
- Ubuntu USN-8948-1, 21 October 2026 — full fixed package revisions for supported Ubuntu releases; consult the notice for your exact release and package.
- Debian tracker: CVE-2026-109618 and CVE-2026-109619 — distribution-specific package status.
- Hostinger, updated 22 October 2026 — example of the managed-hosting versus self-managed VPS distinction. Provider statements are not independent attestations by this tool.
Rules and limitations
Only stable, plain upstream versions in branches 8.2–8.5 are numerically compared, against 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 respectively. A branch is never compared numerically to another branch. Suffixed builds and vendor/unknown sources require advisory evidence instead. Pre-releases and other branches go to manual review.
Backported packages are deliberately not automatically marked patched. A valid vendor package comparison needs the OS release, package origin, full revision and both advisories. The example Ubuntu revision is illustrative, not a universal recommendation.
Even a matching upstream version does not establish which binary is active, whether all workers restarted, whether configuration differs, or whether a site was compromised before patching. Answers that you have evidence remain self-reported. The tool issues no “safe” verdict.
Privacy
Inputs are processed by JavaScript in your browser. This application has no input submission endpoint, tracking script, account, payment or local-storage feature. Downloads are generated locally. Ordinary page and asset requests go to the hosting platform, whose infrastructure may keep access logs. Following a source link contacts that source.
Updates and independence
Initial rules were reviewed on 23 October 2026. This is a dated snapshot, not a live vendor database. Consult the original advisories before acting; provider rollouts and supported releases can change. Material corrections should update this review date and rules together.
Created as an independent website-owner utility. Unaffiliated with PHP, the PHP Foundation, hosting providers or vulnerability discoverers. It does not replace your provider or security administrator.