How do I know whether my site is affected?

The short answer

If the site runs on PHP (WordPress, Drupal, Joomla, Magento, MediaWiki, and Laravel all do) and the running PHP version is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 without a distribution backport, it is affected. Check the version where the code runs, after the restart, not the package list. For bought-in products, the Dutch NCSC keeps an inventory of 674 products and their status.

To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/am-i-affected/index.html

The answer, with its sources

Every PHP installation serving web requests is in scope, says php.net: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, with mod_php at highest risk. The flaw runs before any application code, so your own code is not the question. php.net PHP

Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 7.4 to 8.1 are affected too and get no release from PHP. php.net php-src oss-security

Check the running version (php -v inside the container, or phpinfo() on the box) after restarting, and check vendors that bundle PHP. NCSC-NL BACS

For products you did not build, the NCSC-NL inventory lists 674 products: 206 vulnerable, 46 fixed, 418 under investigation and 3 not vulnerable when it was counted. NCSC-NL

The pages that carry it

• Affected systems: versions, deployments, applications, inventory
• The NCSC-NL inventory: 674 products
• If you run PHP: the steps, in order, with their sources
• Briefing for a developer: Is my code the problem, what do I change, and how do I check the box I deployed to?