After the October 2026 PHP fixes
Patch the HullIs your website's PHP version past the fix?
Type the version your hosting panel shows and answer five quick questions. The page checks it, for free, against the fixed builds published on 21 October 2026 and places your site on the hull. One run writes a plain-language patch-night runbook that names who does each step.
1 Your site free
2 The hull free
3 Ask for the runbook
One run turns your answers into 3 to 6 steps with who does each one, what to do if it stalls, how to recover, and a note for the person who changes the server. The page's verdict stays as it is.
The runbook - none yet
-Note for the person who changes the server
The page's check
4 Saved checks
How the page decides
On 21 October 2026 the PHP project published fixes for two remote-code flaws, CVE-2026-109618 and CVE-2026-109619, in versions 5.4 to 8.5. Fixed builds came out for four lines: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Lines 7.4, 8.0 and 8.1 got source patches only, with no official builds. Lines 5.4 to 7.3 got no fix.
The verdict, first match wins: no full version the page can read (blank, unreadable, a line that never existed, a line above 8.5, or an 8.2 to 8.5 line without its build number) - find the version; a line older than 5.4 - move to a supported line; 8.2 to 8.5 at or past the fixed build - fixed build; below it - update now; 7.4, 8.0 or 8.1 - backport or move up; 5.4 to 7.3 - move to a supported line.
Linux distributions and hosting panels often backport fixes without changing the version number, so an older-looking number from such a build may already be fixed - ask whoever maintains it. Check php.net for releases after 21 October 2026. This is an independent plain-language helper, not affiliated with the PHP project and not professional security advice. Never send passwords or logins in a note, and keep the site's settings out of public places.