Free utility · Cyber Centre alert AL26-026
Is your site’s PHP version affected?
Enter a website you own or manage. We make one normal request to it, read the PHP version its server announces, and compare that against the fixed releases in AL26-026. Nothing is probed or exploited.
Check a website
Result
- Reported PHP version
- X-Powered-By header
- Server header
- Response
A version header is what the server chooses to say. Linux distributions (Ubuntu, Debian, Red Hat and others) often backport security fixes without changing the version number, and a CDN or firewall in front of a site can hide or rewrite the header. Treat this as a prompt to confirm, not a final answer.
Ask FioSec to confirm and help patchAbout the advisory
Critical vulnerabilities impacting PHP
Use-after-free flaws (CWE-416) in PHP that could let an unauthenticated attacker run arbitrary code on an affected server. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on October 26, 2026. The advisory’s Update 1 adds a third issue (CVE-2026-115560); read the advisory for its scope.Source: Canadian Centre for Cyber Security, alert AL26-026 (opens in a new tab).
Affected and fixed releases
| Branch | Affected | Fixed in | Security fixes until |
|---|---|---|---|
| PHP 8.5 | 8.5.x before 8.5.12 | 8.5.12 | 2029-12-31 |
| PHP 8.4 | 8.4.x before 8.4.27 | 8.4.27 | 2028-12-31 |
| PHP 8.3 | 8.3.x before 8.3.36 | 8.3.36 | 2027-12-31 |
| PHP 8.2 | 8.2.x before 8.2.35 | 8.2.35 | 2026-12-31 |
| PHP 8.1 and older | No longer supported by the PHP project; no fixed release is published. Ask your vendor about backported fixes, or upgrade to a supported branch. | ||
If your site is affected
- Confirm the real version on the server (
php -v, or your hosting control panel). The header can lag behind or be hidden. - Update PHP to the fixed release for your branch, or apply your distribution’s security update if it backports the fix. Managed hosts usually publish a notice; ask them if you cannot find one.
- Restart the web server or PHP-FPM so the new version is actually serving requests, then re-run this check.
- If you are on PHP 8.1 or older, plan the upgrade to a supported branch now; there is no fix to wait for.
- Because these flaws are being exploited, review web server logs for unexpected activity around the time of patching, and consider hiding the version header (
expose_php = Off) so future issues are harder to target.
What this check does and does not do
- It makes one standard web request to the address you enter, the same as loading the page in a browser, and reads the response headers. It does not scan ports, probe paths, submit forms, or send any exploit.
- It only checks public websites on the standard web ports. Private networks and internal addresses are refused.
- It does not store the pages it fetches. Ordinary request logs exist on our hosting, as they do for every page on this site.
- It cannot see PHP that is hidden behind a CDN, a firewall, or an
expose_php = Offsetting, and it cannot tell whether a distribution has backported a fix. For a definitive answer, check on the server or ask us to help.