Is your PHP site affected?
Two critical PHP flaws can expose applications running on affected versions. Check the version your site discloses, then patch the live runtime.
Use a site you own or manage. The check sends ordinary GET requests and reads the PHP version in response headers. Nothing is exploited.
Fixed releases.
These upstream PHP releases contain the fixes. A version below the threshold on a covered branch needs attention.
Checking current PHP releases…
Four steps to a safer runtime.
The application can be fully updated while its PHP runtime remains exposed. Focus on the version actually serving traffic.
Upgrade PHP
Install a fixed upstream release or a vendor package with fixes for both vulnerabilities.
Restart workers
Restart PHP-FPM, Apache, LiteSpeed, containers, and any other PHP workers so the patched runtime is loaded.
Verify the live site
Check the PHP version used by production web requests. A CLI version alone does not prove your web stack is patched.
Restrict access if needed
If patching is delayed, limit public exposure until your hosting team can deploy the fix.
The runtime sits beneath your app.
WordPress, Laravel, Drupal, Magento and other PHP applications can be affected through a vulnerable PHP runtime, regardless of the application version. Updating the app alone does not patch PHP.
Evidence from the response.
The agent reads version headers and PHP session-cookie presence, then compares any disclosed version with the fixed releases. A hidden version or vendor backport can change the answer. The supplied Nuclei template includes intrusive crash probes; this site does not run them. Confirm the installed and running PHP package on the host.
Read the advisories.
Use upstream guidance to confirm impact, patch status, and any later changes to this advisory.