PHP Check · Beta

How is your PHP doing?

Check whether your website’s publicly reported PHP version matches the current vulnerability. A free quick check with a clear assessment.

Privacy and process

Paths and URL parameters are removed. The target sees our server’s IP. Results and hashed target identifiers are processed briefly for caching and request limits; your check is not published.

Take a closer look on your server

Beta

Run the script over SSH using your application’s PHP binary. It reads the version, runtime and selected settings locally and sends nothing to us.

Terminal one-liner

( dd_php_file=$(mktemp) || exit; trap 'rm -f "$dd_php_file"' EXIT HUP INT TERM; curl --proto '=https' --tlsv1.2 -fsS --max-time 20 'https://dashdesign.eu/tools/php-check/diagnose.php?locale=en' -o "$dd_php_file" && php -r 'if(hash_file("sha256",$argv[1])!=="1f73e9774a5e32c69d16c229d1c58494f7fcc6f53a46e0af81b47f182145ff76"){fwrite(STDERR,"SHA-256 mismatch\n");exit(1);}require $argv[1];' "$dd_php_file" )

Requires curl and PHP. Downloads to a temporary file, verifies SHA-256 and runs without sudo. Read the source first. CLI PHP may differ from web PHP; the script verifies neither web patch status nor vendor backports. Do not place it in a public web directory.

Download PHP script

View and copy the complete script

<?php
// dashdesign; PHP Check — Beta. Read-only, no network requests, no upload.
// Source: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
// Rules reviewed: 2026-10-21. Run with the PHP binary you want to inspect.
if (PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg') {
    http_response_code(403);
    exit('CLI only. Do not publish this file in a web directory.');
}
$fixes = array(
    '8.2' => 35,
    '8.3' => 36,
    '8.4' => 27,
    '8.5' => 12
);
$status = 'unknown';
$required = null;
if (preg_match('/^(\d+)\.(\d+)\.(\d+)$/D', PHP_VERSION, $parts)) {
    $branch = $parts[1] . '.' . $parts[2];
    if (isset($fixes[$branch])) {
        $required = $branch . '.' . $fixes[$branch];
        $status = ((int) $parts[3] >= $fixes[$branch]) ? 'patched' : 'affected';
    } elseif ((int) $parts[1] >= 5 && ((int) $parts[1] < 8 || ((int) $parts[1] === 8 && (int) $parts[2] < 2))) {
        $status = 'affected';
    }
}
$labels = array('affected' => 'Probably affected', 'patched' => 'Probably patched', 'unknown' => 'Unable to determine');
$report = array(
    'tool' => 'dashdesign; PHP Check Beta',
    'advisory' => 'https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w',
    'rules_reviewed' => '2026-10-21',
    'checked_at' => gmdate('c'),
    'verdict' => $status,
    'result' => $labels[$status],
    'php_version' => PHP_VERSION,
    'minimum_fixed_release_for_branch' => $required,
    'sapi' => PHP_SAPI,
    'web_runtime_verified' => false,
    'vendor_backport_verified' => false,
    'memory_limit' => ini_get('memory_limit'),
    'post_max_size' => ini_get('post_max_size'),
    'file_uploads' => (bool) ini_get('file_uploads'),
    'note' => 'Only the local CLI PHP runtime was checked. Web PHP and other pools may differ. Vendor backports cannot be detected. No exploit test.'
);
echo json_encode($report, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . PHP_EOL;

Need a precise assessment?

Konrad Mayer can help review the actual web PHP version, vendor packages and affected applications, and plan the next steps.

Request a detailed analysis

Konrad Mayerinfo@dashdesign.eu +49 6401 2290437

One vulnerability. A cautious assessment.

This beta check covers only GHSA-w8hw-w9fx-j79w (CVE-2026-109618). It is not a complete security audit. Unknown, ambiguous and prerelease versions are never labelled patched.

8.2.35 · 8.3.36 · 8.4.27 · 8.5.12

Rules reviewed: 2026-10-21 · PHP Security Advisory