Is PHP 8.4.27 vulnerable?
Yes. PHP 8.4.27, released on 21 October 2026, is the 8.4 release that patched CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, Critical).
- Released
- 21 October 2026
- Branch
- PHP 8.4 — Still receiving security updates.
- Fix shipped in
- PHP 8.4.27 — The first 8.4 release carrying the October 2026 patch.
- Newest on this branch
- PHP 8.4.27 — This is the newest release on this branch.
What version is your site actually running?
Check any site below. We load the homepage once and read what it reports — no signup. Most servers hide their PHP version, which is the right thing for them to do, so if nothing comes back the page explains where to look instead.
No signup. We load your homepage once — the same single request any visitor makes — and report what it tells us. Nothing else on your site is touched.
Other PHP 8.4 releases
Common questions
Is PHP 8.4.27 affected by CVE-2026-109618?
Yes. PHP 8.4.27, released on 21 October 2026, is the 8.4 release that patched CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, Critical).
What PHP version should I upgrade 8.4.27 to?
Nothing, on this branch — PHP 8.4.27 is the newest 8.4 release, so you are already current. The only move left is to a newer branch, which buys you a longer support window but is more likely to need plugin or code changes. Test it on a staging copy first.
How do I check which PHP version my site runs?
In WordPress, go to Tools → Site Health → Info → Server; the PHP version is the first line, and you need no cPanel, FTP or SSH access. You can also paste your address into the checker on this page, though most servers hide their version — in a sample of twenty WordPress sites, only one published it.
Release dates from php.net’s release index. Advisory details from the PHP project’s own security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, both CVSS 9.2, published 2026-10-21.