Your website
Your message
Copy it as it is, and send it to your hosting company or the person who built your site.
What stays on your device
This page makes no connection to any other computer. The address and name you type are used only to fill in the message on your own screen, and nothing is saved when you close the tab.
Why these questions
On 21 October 2026 the PHP project released emergency updates for two critical flaws. PHP is the programming language that runs a large share of websites, so the company that hosts your site has to install the update on the server; you cannot do it from your own computer. On 28 October the United States Cybersecurity and Infrastructure Security Agency added a flaw in the Linux operating system to its list of flaws used in real attacks, and it can be combined with the PHP flaws to take full control of a server. The full story is in our article on the PHP flaws, and the project’s own notices are on the PHP project’s news page.
The message asks five things. Which PHP version the site runs and when it was updated. What protects the site if it was not updated. Whether the server’s Linux operating system has the 28 October update. Whether the server was checked for signs that someone got in before the updates. And whether the setting the PHP project suggested on 23 October is switched off.
What a good reply contains
A good reply is in writing and names a PHP version that is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer on its line, with the date it was installed. If your host uses a Linux supplier that fixes problems without changing the version number, a good reply says so and names the supplier’s update. For the Linux flaw, it names the kernel version or the supplier’s update. For the check, it says what was looked at and what was found. A reply that says only “we are on top of it” has not answered the questions, and you can ask again for the version and the date.
PHP 8.1 and older no longer receive updates from the PHP project. If that is your version, ask whether your host has a supplier fix, or when the site can move to a newer version.
What this tool cannot do
It writes a message, and it cannot see your server. It cannot tell you whether your site is affected or whether anyone got in. The numbers in the message were current when this page was published, and the story is still developing, so the article above carries the latest.
Questions and answers
What does this tool actually do?
It writes a message that you send to your hosting company or web developer. The message asks which PHP version your site runs, when it was updated, whether the server’s Linux operating system has the latest update, and whether the server was checked for signs of entry.
Can this tool tell me if my website has been hacked?
No. It cannot see your server. Only the people who run it can check, which is why the message asks them to say in writing what they checked and what they found.
I use WordPress. Do its automatic updates fix this?
No. The flaw is in PHP on the server, and not in WordPress, so WordPress’s own updates do not change it. Your host has to update PHP, and the message asks them to confirm that was done.
I use Wix, Squarespace or Shopify. Do I need to ask?
These services run the servers themselves. You can still ask their support team to confirm in writing that the updates are done, and the page writes a short message for that.
Does UtilForge.org keep what I type?
No. The address and name stay on your own device and are used only to fill in the message on your screen.