PHP Unauthenticated RCE (CVE-2026-109618 & CVE-2026-109619) Version Detection

Could this critical PHP vulnerability affect your website?

Best-effort fingerprinting template for CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state in session.upload_progress). Both are critical (CVSS v4.0 9.2) unauthenticated RCE vulnerabilities in the PHP runtime. Detection extracts the PHP version from HTTP response headers (X-Powered-By, Server) or common PHP info pages and compares it against fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). PHP 5.x, 6.x, and 7.x are end-of-life and remain vulnerable. Since the flaw resides in the PHP interpreter, a black-box HTTP check can only identify version exposure and does not attempt exploitation.

Enter a domain you own and we will test it right now — and, while we are there, report anything else it exposes publicly. No account, no agent to install.