Is my website affected by PHP2Shell? How to check your PHP version

WindowsMacUpdated

PHP's security team released fixes on 21 October 2026 for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which the US agency CISA says are known as "php2shell". The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. To know where your site stands, you need one number: the PHP version your host runs it on.

Quick answer

Find your site's PHP version in WordPress under Tools > Site Health > Info > Server, in your hosting control panel, or by asking your host. According to the PHP advisory, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If yours is older than the fix for its branch, ask your host to update it.

Which PHP versions are affected and which are fixed?

The PHP advisory of 21 October 2026 says the flaws affect all PHP installations serving web requests, and can allow unauthenticated remote code execution. In plain terms, someone could run their own commands on the server without logging in. The UK's National Cyber Security Centre (NCSC) puts it simply: "Organisations using any version of PHP are affected."

The PHP project lists one fixed release per supported branch:

Your version starts withFixed in
8.58.5.12
8.48.4.27
8.38.3.36
8.28.2.35

The release notices that went with those versions say: "There are no complete mitigations, updating is the only safe choice."

On exploitation, as of 23 October 2026: CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". The PHP advisory says there is a demonstrated exploit against one common setup, Apache with mod_php, which it rates highest risk. CISA adds that the vulnerabilities pose a risk if left unpatched.

How do I check my PHP version in WordPress?

WordPress shows it in Site Health. WordPress's own "Update PHP" page gives these steps.

  1. Log in to your WordPress dashboard.
  2. Go to Tools > Site Health.
  3. Click the Info tab.
  4. Expand the Server section.
  5. Scroll down to PHP version.

WordPress describes the Info tab as information only, so you can't change anything from there. While you're in Site Health, the Status tab may also show a critical issue called "Your site is running an outdated version of PHP, which requires an update". WordPress lists that one as a security issue.

How do I check my PHP version in cPanel?

If your host gives you cPanel, its MultiPHP Manager lists your domains and the PHP version each one uses. cPanel's documentation files the tool under Software.

  1. Log in to cPanel.
  2. Open MultiPHP Manager.
  3. Find your domain in the list and read its PHP version.

If the domain shows an Inherited label, cPanel says it is using the system default, which only the server administrator sets. In that case the version on screen is your host's choice, and so is the update. If you can't find MultiPHP Manager, your host may have switched it off, which cPanel says they can do.

Other hosting panels have their own screens for this, and the names vary. Your host's help pages are the place to look.

What if I can't find my PHP version?

Ask your host. WordPress's "Update PHP" page suggests emailing your host when you can't find the setting yourself, and offers a template asking what steps are needed to move to the latest PHP version. For this issue, ask two plain questions:

  1. Which PHP version is my site running on right now?
  2. Has it been updated to the fixed release from the 21 October 2026 PHP security advisory (8.5.12, 8.4.27, 8.3.36 or 8.2.35)?

If you have more than one site or domain on the account, ask about each one. cPanel's documentation shows that each domain can run a different version.

My version isn't fixed. What do I do?

Update PHP, or have your host do it. The PHP advisory lists some temporary settings that reduce exposure, but it says they "do not make an installation safe". The NCSC's order of advice is: update, apply the temporary mitigations if you can't update, and consider taking the system offline if neither can happen quickly. CISA also says to take a site offline if it can't be updated right away.

How you update depends on who runs the server:

  1. On shared or managed hosting, PHP belongs to your host. Ask them to move your site to the fixed release, or to a supported branch that has one.
  2. If your panel lets you choose a version, you may be able to switch it yourself. Our guide on how to update PHP on WordPress goes through it, with a backup first.

If you can't update straight away, the NCSC advises checking the system for signs of compromise. Our guide on what to do if your website is hacked covers that from a site owner's side.

What if my site runs PHP 8.1 or older?

The PHP project says PHP 8.1 and older "no longer receive updates from the PHP project". It adds that some distributions and long-term support vendors provide backported fixes, and says to contact your vendor for details or upgrade to a supported version. The PHP security team also published minimal backports for 7.4, 8.0 and 8.1, aimed at people who build PHP themselves.

For a personal site, that means asking your host directly whether they have applied a backported fix to your version. If they haven't, the answer the PHP project gives is to move to a supported version. CISA's alert says to take systems running PHP 8.1 or earlier offline if they can't be updated right away.

PHP's supported versions page also shows that PHP 8.2 gets security support only until 31 December 2026, so a site on 8.2.35 is fixed for now but will need a newer branch soon. WordPress's "Update PHP" page recommends PHP 8.3 or higher.

Can an online PHP vulnerability checker tell me if I'm safe?

None of the official pages listed below mention online checkers. What the PHP advisory gives you is a list of fixed versions, so the check that matters is the version your site runs and whether it is at or above the fix for its branch. Your host can confirm that, and Site Health or your panel will show it.

More questions

What is PHP2Shell?

It's the name CISA says the two vulnerabilities CVE-2026-109618 and CVE-2026-109619 are known by. Both are flaws in PHP itself, not in WordPress or a plugin. The PHP advisory says they can allow unauthenticated remote code execution on servers that use PHP to serve web pages. Our PHP2Shell explainer covers it in more depth.

Is PHP 8.3.36 safe from PHP2Shell?

PHP 8.3.36 is the fixed release for the 8.3 branch, according to the PHP advisory of 21 October 2026. The other fixed releases are 8.5.12, 8.4.27 and 8.2.35. PHP also published a further informational advisory on 23 October about a separate, unlikely issue affecting unusual session setups.

Does this affect my WordPress site if WordPress is up to date?

Yes, it can. The flaws are in PHP, the language WordPress runs on, and the advisory says all PHP installations serving web requests are affected. Keeping WordPress, themes and plugins updated is still good practice, but the fix for this issue is a newer PHP release.

My host says it's patched. Do I need to do anything?

Check the version in Site Health or your panel against the fixed list, so you know it applies to your site. If you have several domains, check each one. If you have reason to think the site was changed before the update, look for signs of compromise, as the NCSC advises.

Sources