Test your website's security posture instantly. Audit missing HTTP security headers, SSL certificate expiry, exposed server versions, and verify whether your PHP runtime is patched against critical advisories including PHP2Shell (CVE-2026-109618 & CVE-2026-109619). Safe, read-only — no signup.
Validating host & running SSRF safety checks…
Run a scan to check whether the server exposes a PHP branch affected by CVE-2026-109618 / CVE-2026-109619.
Review prioritized vulnerabilities, missing headers, and configuration enhancements.
Paste these directives into your server config to deploy the missing security headers and suppress version leakage.
Our defensive checker inspects your public HTTP response headers, SSL handshake, and server footprint without sending any malicious requests.
Validates the hostname, resolves A/AAAA DNS records, and blocks private, loopback, and reserved networks before any request is made.
Sends read-only GET requests to inspect HSTS, CSP, X-Frame-Options, and software version disclosures.
Reads the peer certificate to verify issuer trust, validity, and days until expiry.
Checks any advertised PHP version against the CVE-2026-109618 / CVE-2026-109619 advisory and generates server hardening snippets.
PHP2Shell is the industry nickname for two critical vulnerabilities in the core PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. They allow pre-authentication remote code execution — an attacker can run code on the server with nothing more than a crafted web request, no login required. Because the flaws live in PHP core, they affect anything that runs PHP to serve web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed).
The PHP team released emergency patches on October 21, 2026. Any server running a version below its patched release should be upgraded immediately:
Advisory data current as of October 2026 — confirm the latest patched PHP release at php.net.
| PHP Branch | Minimum Patched Version | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Patched Release |
| PHP 8.4 | 8.4.27 | Patched Release |
| PHP 8.3 | 8.3.36 | Patched Release |
| PHP 8.2 | 8.2.35 | Patched Release |
| PHP 8.1 & Older | None (EOL) | End of Life |
HTTP security headers are directives your web server sends to the visitor's browser. They add defense-in-depth against common client-side threats — cross-site scripting (XSS), clickjacking, MIME-confusion, and protocol downgrade attacks.
Deploying them needs zero changes to your application code — they are set globally in your web server config (Apache, Nginx, LiteSpeed) or at the Cloudflare edge.
| Header | Threat Protected | Impact |
|---|---|---|
| Strict-Transport-Security | SSL stripping / MITM | Critical |
| Content-Security-Policy | XSS & data injection | Critical |
| X-Frame-Options | Clickjacking | High |
| X-Content-Type-Options | MIME-sniffing | Medium |
| Referrer-Policy | Token / URL leakage | Medium |
| Permissions-Policy | Unauthorized hardware access | Low |
Expert answers on website security testing, PHP patch verification, and header hardening.
Security headers are an essential layer of browser defense against clickjacking, XSS, and downgrade attacks, but they are only one part of defense-in-depth. A complete posture also needs patched server runtimes (PHP, Nginx), secure credentials, updated plugins, and proper authentication controls.
Enter your URL in this tool. If your server emits the X-Powered-By header, the version is detected instantly. If it is hidden (good practice), check your hosting control panel (cPanel, Cloudways) or the Site Health screen in WordPress Tools.
Unpatched releases below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (all released before October 21, 2026) are affected. Older end-of-life branches such as PHP 8.1, 8.0 and 7.x receive no patches and should be upgraded immediately.
Update PHP to a patched release (8.2.35, 8.3.36, 8.4.27 or 8.5.12). On managed WordPress hosting, ask support to update your PHP version. On an unmanaged Ubuntu/Debian VPS, run apt update && apt upgrade php* and restart PHP-FPM/Apache.
They are instructions your web server returns that tell browsers how to handle your content securely — refuse non-HTTPS connections, block unauthorized iframe embedding, disallow MIME-sniffing, and prevent cross-site script execution.
HSTS (Strict-Transport-Security) forces browsers to use HTTPS, preventing downgrade/MITM attacks. Content-Security-Policy (CSP) is a granular ruleset that restricts which domains can run scripts, load images, or fetch resources on your page — the main defense against XSS.
PHP 8.2 is safe once updated to 8.2.35 or higher with the October 2026 security fixes. Since 8.2 is nearing the end of its security support, plan a migration to 8.3 or 8.4.
Hiding it does not patch underlying code, but it removes easy reconnaissance data used by automated vulnerability crawlers. Suppressing server and PHP version signatures is a recognized CIS Benchmark and OWASP hardening guideline.
Access our full collection of free diagnostic, payroll, and technical SEO utilities — 100% free, no registration.
H&U Solutions hardens web infrastructure, resolves unpatched PHP vulnerabilities, and deploys security-header policies for businesses across Saudi Arabia and internationally.
A premier web development and digital agency engineering high-performance platforms and Advanced AI/GEO tools.
