Free · read-only · nothing is changed

Am I exposed? Check your server in two minutes.

A short script that reports your PHP version, how PHP is served, the five settings that matter for CVE-2026-109618 and CVE-2026-109619, and whether a patched package is available to you. It only reads. Send us the output and we reply with your position, free.

How to run it

Log in to the server over SSH, or open a terminal in your container, as the user the website runs as. If you use a managed host, send this page to their support and ask them to run it.
Run:

curl -fsSL https://keepphpup.com/exposure-probe.sh | sh

If you would rather read it first, which we recommend for anything you run on a server, open the script. It is about forty lines of plain shell and every command is a read.

Copy the whole output and email it to melchor@keepphpup.com. You get back, the same working day: your version's status, what you can apply yourself, and whether the paid 48-hour check makes sense for you.

What it looks at

Reported	Why it matters
Every PHP binary and PHP-FPM version installed	Places you in the fix table: package fix, source patch only, or nothing.
Whether Apache loads mod_php, and which web server runs	mod_php is the highest-risk configuration for the memory bug.
`session.upload_progress.enabled`	One path into the stale-state bug; on by default, rarely needed.
`memory_limit`, `post_max_size`, `upload_max_filesize`	The settings the advisories use to bound the memory path.
`fatal_error_backtraces`	PHP 8.5 only; another path into the stale-state bug.
Installed PHP packages and the candidate update for each	Tells you whether a patched package already exists in your package source.

What it does not do

It does not test the vulnerability. Running exploit code against your own production is a bad idea and we will not do it either.
It does not change any setting, install anything, or send anything anywhere. You choose what to share.
It does not cover application code. Whether your application's framework can move to a supported PHP is the assessment's job.

Already know you are on 8.1 or older?

Skip the script. The 48-hour exposure check is $750, credited against the migration, and ends with a fixed quote for the move.

Email us your PHP version Read the explainer