NodaraNodara
Log inNLRequest a quote

PHP flaw, patched on 21 October

Does your site run on PHP? Get it checked for free.

This week a critical flaw in PHP came to light, the language behind WordPress and many other sites. Paste your website address in the form. We look for signs that your site is still at risk and email you within 1 business day.

~70%
of all websites run on PHP
9.2
out of 10: severity of the flaw (CVSS)
€0
for the check, no strings attached

Free leak check

We only look at what your site shows every visitor. We do not log in and we do not test anything.

We only use your details for this check. Privacy statement

What happened

A flaw in the engine under millions of sites.

PHP is the programming language that WordPress, Drupal and many web shops run on. The flaws named PHP2Shell let an attacker run code on the server without logging in. That is enough to take over your site or steal data.

An update is already out. Whether your site has it depends on your host and on whoever maintains your site.

  1. 21 October 2026Flaws disclosed and patched right away
  2. After thatGovernment and company sites briefly go offline to update
  3. NowSites that have not been updated are still at risk

How the check works

Three steps, nothing to install.

  1. You paste your address

    Website address, name, email and a tick to say the site is yours. That is all.

  2. We take a look

    We look at what your site shows publicly, such as the PHP version and the system underneath. No logging in, no attacks.

  3. You get your report

    Within 1 business day in your inbox, in plain language, with what you may need to do.

Your report

An honest answer, as one of three results.

LEAK CHECK #014222-10-2026
Probably vulnerable

Your site shows an old PHP version.

Ask your host or web developer to install the update as soon as possible.

PHP version
8.2.20
Safe from
8.2.35

We call you to fix it together.

LEAK CHECK #014322-10-2026
Not visible

Your site hides its PHP version.

That is good practice, but it means we cannot see from outside whether the update is installed.

PHP version
hidden
System
WordPress

Book a free 10-minute call.

LEAK CHECK #014422-10-2026
No signs found

We see no sign of the flaw.

Your site shows an updated version or does not run on PHP. Do keep up with updates.

PHP version
8.4.27
Safe from
8.4.27

Tip: with Nodara Zorgeloos we keep track of this for you.

Examples. We cannot see everything from outside: hosts sometimes patch without changing the version number. That is why we never promise a site is safe.

Why Nodara

Our own sites do not run on PHP.

We come from cyber security. That is why we build sites without PHP and WordPress underneath, on a modern setup. This flaw does not affect our clients.

See what we buildCheck my site
  • Security built in, from line one
  • Updates and maintenance with Nodara Zorgeloos
  • Fixed price up front, the code and domain are yours

Sources: Wiz and Help Net Security (21-10-2026). The 70% share is an estimate of PHP use on the web.