This page checks a public website for defensive indicators related to CVE-2026-109618 and CVE-2026-109619, the 2026-10-21 PHP unauthenticated remote code execution vulnerabilities. It sends harmless probe requests: a plain GET, and two multipart POST requests containing a single text field with no attack payload. It never sends the PHP_SESSION_UPLOAD_PROGRESS field and never attempts to trigger, demonstrate, or confirm exploitation.
Results here are indicators only. A blocked multipart request is a good sign, but it does not prove your PHP installation is patched nor that no other exploit path exists. The only confirmed fix is upgrading PHP to the patched release for your branch and restarting all PHP worker processes. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Only test sites you own or have permission to test.
If you see a rate limit message, wait a few minutes and try again. We try to keep this site up by limiting the number of requests per visitor.
This tool is provided as-is, with no warranty of accuracy or completeness.