What this check looks for
Signs that a site has already been broken into, and the big, recent flaws that put a very large number of sites at risk at once - the ones in the news. We add new ones as they come out.
Always
Signs of a break-in
Hacked small-business sites very often get stuffed with hidden gambling or pharmacy spam aimed at search engines, or have their web address hijacked to bounce visitors through a chain of spam sites. We look for both. If we find either, the site needs attention whatever else the check says.
October 21, 2026
The October 2026 PHP flaws
Two flaws in PHP, the software that runs about 7 in 10 websites, that let an attacker run their own commands on a server without logging in. They were made public on October 20, 2026, fixes came out the next day, and attacks started within minutes.
Fixed in: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Versions older than 8.2 get no fix at all. The only fix is updating PHP. There is no setting that switches the risk off.
CVE-2026-109618, CVE-2026-109619 · Source
July 17, 2026
The "wp2shell" WordPress flaws
Two flaws in WordPress itself that, chained together, let an attacker take over a site without logging in. Attackers began using them within a day of the fix, planting back doors and fake admin accounts.
Fixed in: WordPress 7.0.2, 6.9.5, 6.8.6. Versions older than 6.8 aren't affected. Fixed by updating WordPress. WordPress pushed the fix out as an automatic update, but sites with automatic updates turned off can still be exposed.
CVE-2026-60137, CVE-2026-63030 · Source
Always
A secure connection (HTTPS)
Not news, but the basic every site needs. Without HTTPS, browsers warn your visitors, and anything they type into your forms travels unencrypted.
What this check can't see
We only look at what your site shows the public, so a clean result here is good news, not a guarantee. This check can't see your plugins and themes, your passwords, or whether someone already got in before the fix went on.
Most hacked small-business sites are broken into through an outdated plugin or a weak password, not the headline flaws. If you want the whole picture, ask us for a free security check of the rest.
Check it yourself
If your site hides its versions, you can look them up from the inside:
- WordPress: in your dashboard, go to Tools, then Site Health, then the Info tab. "WordPress" shows your WordPress version, and "Server" shows your PHP version.
- Your hosting control panel: cPanel shows PHP under "Select PHP Version" or "MultiPHP Manager". CyberPanel and Plesk list it in each website's PHP settings.
- Ask your host: any host can tell you which PHP version your site runs and whether it has the October 2026 fix. If they can't, ask who is responsible for updating it.
If your site is vulnerable
Update the software named in your result. For PHP, that is usually a setting in your hosting control panel or a request to your host. For WordPress, it is the update button in your dashboard.
Updates can break an old theme or plugin, which is why many sites put them off. We copy the site, update the copy, fix whatever breaks, and only then switch the live site over. On our managed hosting, this is part of the service.
How the check works
We load your home page once, the same way a browser does. Many servers include their PHP version in the response, and many WordPress sites include their WordPress version in the page. We compare those numbers with the fixed versions published for each flaw. We also note which platform or host your site is on, since site builders like Wix and Squarespace patch their own servers, and we look for the spam hacked sites usually carry.
We don't log in, scan for weaknesses or try any attack. We only see what any visitor to your site can see.
Common questions
How do I know if my site is affected by CVE-2026-109618, CVE-2026-109619 or wp2shell?
Enter your web address in the check at the top of this page. It reads the PHP and WordPress versions your site shows the public and compares them with the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for the PHP flaws, and WordPress 7.0.2, 6.9.5 or 6.8.6 for wp2shell. If your site hides its versions, the result tells you how to look them up from the inside.
How can I tell if my website has been hacked?
Common signs are spam you didn't write (often gambling or pharmacy links, sometimes hidden from you but visible to Google), your address sending visitors to other sites, browser or Google warnings, and admin accounts you don't recognize. This check looks for the first two on your home page. If you see any of them, get help quickly - the longer a hack runs, the more it costs to clean up.
Is this check safe to run on my site?
Yes. It is one normal page request, the same as any visitor loading your home page. We don't log in, scan for weaknesses or change anything.
What are the October 2026 PHP flaws?
Two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that let an attacker run commands on a web server without logging in. They were made public on October 20, 2026, and fixed the next day in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older will not get a fix.
My result says to confirm my PHP version. Is that bad?
Not by itself. Hiding version numbers is good practice, and we do it on every server we host. It just means the PHP answer has to come from inside your hosting account. You can look yourself with the steps on this page, ask your host, or ask us for a security assessment.
My server shows an old PHP number but my host says it's patched. Who is right?
Possibly both. Some Linux distributions, such as Ubuntu and Red Hat, fix security holes without changing PHP's version number. When your server reports one of those builds, the result says so, and a check from inside the server settles it.
My site is patched. Am I safe?
Safe from these flaws. But most break-ins come through outdated plugins, themes or weak passwords, which this check can't see from outside. We'll look over the rest of your site for free.
Do you keep my result?
We keep a record of which sites were checked and the result, so we can see which flaws people are worried about. We don't ask for your name or email, and we don't contact anyone based on a check.