AikidoAre you affected?
CVE-2026-109618 · CVE-2026-109619

Are you
affected?

Check your website for PHP memory exhaustion.
Find out what your server reveals and
what to do next.

Check your website

No signup needed

Use a publicly accessible URL. Localhost and private networks are blocked. Include the PHP path you want to check.

Need a definitive result?

Timing alone cannot tell patched PHP from vulnerable PHP. The definitive check sends a larger payload that can crash a PHP worker and interrupt requests. Run it outside peak hours.

No worker-crashing test unless you opt in. Checks still send requests to your server. Each check has a five-minute limit after it starts; queue wait does not count. Two unfinished checks per IP, shared across tabs; finish or cancel one before opening a third.

A small check. A better picture.

Identify your PHP surface

Headers and timing signals help identify PHP on the exact path you provide.

Know where you stand

Read the evidence, understand the limits, and take the right next step.

A little context.

What we're checking,
and what you should know.

What is the vulnerability?

CVE-2026-109618 and CVE-2026-109619 concern specially nested multipart field names that can consume excessive memory while PHP parses a request, before your application runs. On affected configurations this can exhaust the memory limit and terminate a request or PHP worker. This check targets that memory-exhaustion behavior, not every PHP vulnerability.

Will the check affect my website?

The default check sends fingerprint requests and repeated timing requests. It does not run the destructive oracle. The timing probe is sized using a 128 MB memory-limit hint, so unusually low memory limits can still cause a failed request. The optional definitive check is always visible in the form and must be explicitly enabled. It can crash a worker and interrupt requests. Only test websites you own or are authorized to test. Runs stop after five minutes from their actual start, excluding queue wait; an unfinished check produces no verdict. Stopping cannot undo requests already sent and may interrupt cleanup.

Does a clean result mean I'm safe?

No. A clean definitive check can mean patched PHP or a memory limit above the probe's reach. Timing and headers cannot distinguish those cases. PHP 7.4–8.0, a WAF block, a timeout, or missing PHP signals can leave the result inconclusive. Check your installed PHP version and patch status directly.

What happens to my scan data?

This app keeps queued and running scans and up to 300 recent scans in server memory so your browser can retrieve them. Each engine version and environment allows 50 running checks and 250 waiting checks (300 outstanding). Waiting checks start in submission order as slots become available. You can cancel while waiting or running. When all 300 places are occupied, new submissions receive HTTP 503; try again after a place frees. Only finished scans are removed from history to make room. Reports are not saved to a database and disappear when the Sandbox session ends. Accepted submissions also record your IP and the tested URL (without its query string) in Vercel runtime logs, retained according to the project's log settings. Avoid putting secrets in your URL, including its path.

Security should be simple.
Knowing is a good place to start.

Meet Aikido