CVE-2026-109618 · CVE-2026-109619
Is your PHP exposed?
Check if your server is vulnerable to PHP memory exhaustion. Enter a URL and we'll probe it with safe evidence-based tests.
Sample result
https://example.com/index.phpLikely vulnerable
OOM signal observed · timing delta 4.2s
8.1.2
200 OK
Unpatched
Yes
Yes
+4.2s delta
Yes
Probe triggered severe slowdown or crash signal.
Next Steps: Treat as high priority. Patch PHP to a fixed release and retest off-peak.
Check your URL
Results
Enter a URL and click "Run check" to see fingerprint and timing results.
Safe by default
Fingerprint and timing tests are non-destructive. Real payload test—which may disrupt a worker—requires explicit opt-in.
Evidence-based
Raw response headers, timing deltas, and disruption signals. You can verify the results independently.
Proof-first methodology
Built on the same evidence standard as PandaONE's continuous offensive testing platform.
FAQ
CVE-2026-109618 and CVE-2026-109619 are PHP memory exhaustion bugs. Deeply nested multipart field names can consume gigabytes of memory before your application code runs, causing the PHP worker to crash.