PHP security assessment · 2 CVEs in scope

Check your exposure to two critical PHP vulnerabilities.

Tell dyd↻ about your website and its PHP setup. It compares what you know with the official advisories, shows the evidence behind each result, and tells you what to do next.

  • CVE-2026-109618Remote code execution via out-of-memory corruption
  • CVE-2026-109619Remote code execution via stale global state

You will need

  • Your website domain
  • The PHP version, and where you read it
  • Whether the update was installed and PHP restarted

Any detail you do not know is fine: dyd↻ explains how to find it and says plainly what stays uncertain.

Runs in your browser. No account, tracking or upload. The only outbound request is the optional reachability check that you start yourself.

Assessment

  1. 1Site
  2. 2Hosting
  3. 3PHP
  4. 4Update status

Only the host name is used. Never enter passwords, keys or tokens. A domain alone does not reveal which PHP runtime serves the site.

optional

Sends one HTTPS request from your browser to the domain you entered. dyd↻ receives nothing. An answer proves only that the site responded; it does not show the PHP version, and a failed request does not mean the site is down.

Your answers so far

How dyd↻ decides

Each vulnerability is evaluated separately. Every fact is labelled as declared by you, verified by dyd↻, inferred, or unknown. Checks run in a fixed order and stop at the first one that decides.

Affected according to the available evidence

The declared version is below the fixed version, the version comes from the PHP that serves the site, and nothing contradicts it. A restart does not change this.

Remediation supported by the available evidence

The declared version is at or above the fixed version, it comes from the PHP that serves the site, you confirmed an update and a restart, and no other runtime is in doubt. This is a statement about these two CVEs only.

Needs further verification

A detail is missing, unconfirmed, contradictory or outside the verified rules. dyd↻ does not guess.

Order of the checks

  1. Missing or malformed input stops here and shows errors beside the fields.
  2. Unsupported environments, provider-managed PHP, non-official Docker images and Plesk on Windows need further verification.
  3. Pre-release versions, unsupported branches and package versions in an unexpected format need further verification.
  4. Each CVE is compared with the fixed version for the selected environment, using that environment's own method.
  5. An update that you say was installed, but a version below the fixed one, is a conflict that needs clarification.
  6. A version that is not confirmed as coming from the PHP serving the site needs further verification.
  7. Below the fixed version: affected. At or above it: remediation is supported only if you confirmed the update and a restart and did not say that other PHP runtimes exist; otherwise it needs further verification.

What dyd↻ never does

  • It never claims or implies that a server was scanned, audited or certified.
  • It never logs in, reads credentials or asks for them.
  • It never infers a PHP version from a CMS, a server header or a domain name.
  • It never treats a failed browser request as proof that a site is vulnerable, fine, or offline.
  • It never judges other CVEs or presents a mitigation as a replacement for updating.

Coverage

Generated from the rules file. Distribution packages are compared only with the package version of the selected release, never with upstream PHP numbers.

Show the verified rules

Always "Needs further verification"

Official sources

Every rule links to the sources it was derived from. The rules were checked by reading these pages; an independent human review is still pending.

Privacy and limits

Nothing you enter is stored or uploaded. The page uses no cookies, no browser storage and no analytics. After the page has loaded it makes no requests of its own, except the optional reachability check, which sends one HTTPS request from your browser to the domain you entered, only when you press the button.

Reports are created in your browser. You can print or save them locally; nothing is submitted.

The page itself is served by GitHub Pages, which may process visitor IP addresses under its own policy.

  • The result depends on what you declare. A wrong or outdated answer gives a wrong result.
  • Only these two advisories are covered. This is not a security audit.
  • A web page cannot read the PHP runtime, packages or processes of a remote server.

dyd↻ is an independent project and is not affiliated with or endorsed by the PHP Group, Debian, Ubuntu, Docker or Plesk. The name "dyd" has not undergone trademark or domain clearance.