Two critical PHP vulnerabilities published 21 Oct 2026 allow remote code execution without a login (CVSS 9.2). Enter your website and we will check what your site publishes about its PHP version. If it keeps that private, we say so and confirm it for you.
We only load your public homepage. Nothing is scanned, changed or stored.
Both CVEs are in PHP core, not in WordPress, plugins or themes. A specially crafted request corrupts memory during request cleanup and can execute code before any application code runs, which is why login screens, firewalls inside the app and plugin security do not help. The websites at highest risk are the ones still on an end-of-life branch (PHP 8.1 and older), because no official fix exists for them.