Is PHP 7.4.4 vulnerable?
PHP 7.4.4 was released on 19 March 2020, and the PHP 7.4 branch no longer receives security updates. It did not receive the fix for CVE-2026-109618 and CVE-2026-109619, and it will not receive fixes for anything found in future either. The oldest branch still supported is 8.2.
- Released
- 19 March 2020
- Branch
- PHP 7.4 — End of life — no security updates of any kind.
- Newest on this branch
- PHP 7.4.33 — 26 releases have shipped since 7.4.4.
What end of life actually means
The PHP 7.4 branch no longer receives security updates. No patch level on it is current, and nothing found from now on will be fixed for it. That is a different and more durable problem than any single CVE: it will not improve on its own, and backporting by your Linux distribution has its own end date too.
The oldest branch still supported is PHP 8.2, patched at 8.2.35. Most hosts let you change PHP version from their control panel. Take a backup, move up one minor version at a time, and check the site after each step.
What version is your site actually running?
Check any site below. We load the homepage once and read what it reports — no signup. Most servers hide their PHP version, which is the right thing for them to do, so if nothing comes back the page explains where to look instead.
No signup. We load your homepage once — the same single request any visitor makes — and report what it tells us. Nothing else on your site is touched.
Other PHP 7.4 releases
Common questions
Is PHP 7.4.4 affected by CVE-2026-109618?
PHP 7.4.4 was released on 19 March 2020, and the PHP 7.4 branch no longer receives security updates. It did not receive the fix for CVE-2026-109618 and CVE-2026-109619, and it will not receive fixes for anything found in future either. The oldest branch still supported is 8.2.
What PHP version should I upgrade 7.4.4 to?
PHP 7.4 receives no security updates, so staying on it is the problem rather than the patch level. The oldest supported branch is 8.2. Take a backup, change the PHP version in your hosting control panel, and move up one minor version at a time, checking the site after each step.
How do I check which PHP version my site runs?
In WordPress, go to Tools → Site Health → Info → Server; the PHP version is the first line, and you need no cPanel, FTP or SSH access. You can also paste your address into the checker on this page, though most servers hide their version — in a sample of twenty WordPress sites, only one published it.
Release dates from php.net’s release index. Advisory details from the PHP project’s own security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, both CVSS 9.2, published 2026-10-21.