Am I Vulnerable to PHP2Shell? How to Check Your PHP Version
By Glenn Lyvers · Updated · 5 min read
The only question that matters about PHP2Shell is whether the PHP serving your website is patched. Answering it takes about five minutes, but there are two traps that give people the wrong answer, and both of them lead to “I’m fine” when they are not.
Safe version numbers
You are patched if your site runs 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later on that branch, or a vendor build your host confirms includes the October 2026 PHP2Shell fix. Anything on 7.3 or older is vulnerable with no fix available.
Method 1: WordPress Site Health
In your WordPress dashboard, go to Tools → Site Health → Info, then open the Server section. The “PHP version” line is the version WordPress is actually running under, which is exactly what you need. This is the most reliable quick check for WordPress owners because it reports from inside the live site.
Method 2: Your hosting control panel
In cPanel, look for MultiPHP Manager or Select PHP Version. Each domain shows which PHP branch it uses, such as ea-php82 or alt-php81. In Plesk, open the domain and choose PHP Settings. This tells you the branch, but not always the exact patch release, so pair it with Method 1 or 3.
Pay special attention if a domain is set to 7.4, 8.0 or 8.1. Many hosts left old sites on those branches years ago, and they will not receive an official PHP release for this flaw.
Method 3: A temporary phpinfo page
Create a file named something unguessable, such as check-8f3a.php, containing <?php phpinfo();, upload it to your site’s web root, and open it in your browser. The top of the page shows the exact PHP version, the build date and the Server API (for example FPM/FastCGI, Apache 2.0 Handler or LiteSpeed). Delete the file as soon as you have read it; it exposes details an attacker would love.
Trap 1: The command line lies
If you have SSH access, php -v is tempting, but on most servers the command-line PHP is a different install from the one serving web pages. A cPanel server can have a dozen PHP builds side by side. I regularly see servers where the command line reports a current version while the website is still running an old one. Always check the version from the web side, using Method 1 or 3.
Trap 2: Backported fixes keep the old number
Linux distributions such as Ubuntu, Debian and Red Hat, and hosting platforms such as CloudLinux, often fix a flaw by patching their existing build rather than moving to the new upstream version. A patched Ubuntu server can still report PHP 8.3.6, for example, even though it includes the PHP2Shell fix.
So if your version number is below the fixed releases, do not panic yet, and do not assume you are safe either. Check the package instead: on Debian or Ubuntu, apt changelog php8.3 (use your version) and look for CVE-2026-109618; on Red Hat-family systems, rpm -q --changelog on the PHP package. The phpinfo build date is a useful clue too: a build from before October 21, 2026 cannot contain the fix. When in doubt, ask your host directly: “Does the PHP build my site uses include the fix for CVE-2026-109618 and CVE-2026-109619?”
Patched but not restarted
Installing a patched package does not help until PHP restarts. PHP-FPM pools and LiteSpeed workers keep running the old code in memory until they are restarted. If your host or administrator patched the files but never restarted the service, you are still exposed. The phpinfo build date confirms what is actually loaded.
Testing from outside
Searchlight Cyber released an open-source scanner, php2shell-scanner, that tests whether a host is exposed. It is useful for administrators with many servers, but run it only against systems you own or have permission to test.
If your check turns up an old or unclear version, the next step is upgrading PHP. Or hand it to me: my $195 emergency PHP2Shell upgrade covers the check, the upgrade, the restart and the testing. I’m doing a lot of these right now, but same-day service is still likely.
Emergency service · PHP2Shell
I’ll patch your server for $195, fast.
I confirm which PHP your site actually runs, upgrade it to a fixed release, restart every PHP worker, test that your site still works, and check for signs that someone already got in. One flat price per server or hosting account. I’m doing a lot of these right now, but same-day service is still likely.
Common questions
How do I check my PHP version in WordPress?
Go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version shown there is the version your live site is actually running.
Is php -v accurate for my website?
Often not. The command-line PHP is usually a separate install from the PHP that serves web pages, especially on cPanel servers with several PHP builds. Check from the web side with WordPress Site Health or a temporary phpinfo page.
My PHP version is lower than the fixed release. Am I definitely vulnerable?
Not necessarily. Distributions and platforms such as Ubuntu, Debian, Red Hat and CloudLinux backport fixes without changing the version number. Check the package changelog for CVE-2026-109618, check the build date in phpinfo, or ask your host to confirm.
Which PHP versions are safe from PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and later on each branch, plus vendor builds confirmed to include the October 2026 fix. PHP 7.3 and older have no fix.
Do I need to restart anything after patching?
Yes. Restart PHP-FPM, Apache or LiteSpeed so the patched code is loaded. Running workers keep the old, vulnerable code in memory until they restart.
More than malware
Most people meet me in an emergency. It isn’t all I do.
I’ve been building and repairing systems since 1995. Whatever brought you here, there’s a good chance I can help with the rest of it too — and you’ll be dealing with the same person either way.
Hacked, but not WordPress?
Joomla, Drupal, Magento, Shopify, PrestaShop, Laravel, Node, IIS and plain HTML — cleaned the same way, priced the same way.
Take a look →Custom builds & AI systems
Plugins, custom applications, website chatbots and automation — built to do exactly what you need, maintained by the person who wrote them.
Take a look →Servers, speed, SEO & accessibility
Migrations, faster load times, technical SEO and accessibility fixes. Measured improvements, with the numbers to show you.
Take a look →Better web hosting
Fast, secure hosting with SSL and backups included at no extra charge. Clear pricing, no long-term contracts, no surprises.
Take a look →Classes & free tools
Rather learn to handle it yourself? I teach this, and I give away the tools I built for my own cleanups.
Take a look →Something else broken?
Half my work is untangling what someone else started, gave up on, or broke. Describe it in plain words and I’ll tell you honestly.
Take a look →Tell me what’s wrong. I’ll tell you what it takes.
No queue, no call center, no sales pitch — one person who answers, quotes honestly, and does the work.