Do I have PHP installed? How to check on Windows and Linux

WindowsMacUpdated

The PHP manual says the php -v command shows the version of PHP and which kind of PHP it is. Type it at a command line: if a version number comes back, PHP is installed, and you can compare it with the fixed releases the PHP project published on 21 October 2026. If you get an error, Windows can't find PHP.

Quick answer

On Windows, open Command Prompt or PowerShell, type php -v and press Enter. A line starting "PHP" and a version number means PHP is installed. An error means Windows can't find it. The PHP project's fixes for PHP2Shell are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so update anything older the way you installed it.

How do I check if PHP is installed on Windows?

Use a command line. The PHP manual lists -v as the version option, and the command is the same in Command Prompt and PowerShell.

  1. Select Search on the taskbar and type command prompt, the route Microsoft's support pages give. Microsoft says Windows Terminal opens with PowerShell by default, which works too.
  2. Type php -v and press Enter.
  3. Read the first line. It starts with "PHP", then the version number, then the kind of PHP in brackets, such as (cli) for the command line version.

If you know where a copy of PHP sits but the command isn't found, the PHP manual shows PHP being run by its full path, for example C:\php\php.exe. Typing C:\php\php.exe -v, with your own folder, checks that copy.

On a Mac, the same command works in Terminal. Our guide to whether PHP2Shell affects your Mac covers it.

What does the result mean?

A version number means PHP is installed and Windows can find it. Compare it with the PHP project's 21 October 2026 advisory, which fixes two critical flaws, CVE-2026-109618 and CVE-2026-109619, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. An older number in the same series needs updating.

An error instead of a version means Windows didn't find php. The PHP manual explains that to run PHP from any folder, you add its location to the PATH environment variable. So an error usually means PHP isn't installed, but it can also mean a copy exists that isn't on your PATH.

The advisory says the people at risk are PHP installations serving web requests, such as PHP-FPM, Apache with mod_php and php-cgi. It doesn't mention PHP used only from the command line, so we can't call that use safe, and the UK's National Cyber Security Centre (NCSC) says organisations using any version of PHP are affected. PHP 8.1 and older get no updates from the PHP project. As of 23 October 2026, the US agency CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication".

Who usually has PHP on their computer?

People who build or test websites, mostly. The PHP manual calls server-side scripting the main target field for PHP.

On Windows, php.net's download page offers its own zip downloads and lists Winget, Chocolatey, Scoop, Docker and WSL (Debian or Ubuntu) as other ways to install it. Its manual also covers running PHP with the Apache or IIS web servers.

PHP can also arrive inside another product. The NCSC asks organisations to watch for updates from vendors whose products bundle PHP.

How do I update or remove PHP on Windows?

Update it with whatever installed it. The PHP advisory says Windows binaries are on php.net's downloads page, which as of 23 October 2026 lists PHP 8.5.12 for Windows, dated 21 October.

  1. Zip download from php.net. Download the fixed version from php.net's Windows downloads. The page says to use Non-Thread Safe builds for the command line or for IIS with FastCGI, and Thread Safe builds for the Apache web server. It recommends x64 builds for almost all Windows installations.
  2. Winget. php.net's install command for 8.5 is winget install PHP.PHP.8.5. Microsoft's documentation says winget upgrade on its own lists apps with an update available, and winget uninstall removes one.
  3. Chocolatey or Scoop. Update PHP through the same tool, using its own commands.
  4. A development tool that bundles PHP. Update the tool, or check its maker's site for a release with fixed PHP.

To remove PHP, use the same route. Microsoft says apps can also be removed under Start > Settings > Apps > Apps & features, then More > Uninstall. If you added the PHP folder to your PATH, as its setup describes, take that entry out when you delete the folder.

After updating, run php -v again and check the number has changed.

How do I check on Linux?

Run php -v in a terminal. The PHP manual says most Linux distributions offer PHP through their own packaging system, and php.net says those builds carry patches added by the build provider, over which the PHP project has no control. So update with your distribution's package manager, and check its security notices: the advisory says some distributions provide backported fixes.

Do I need PHP to use websites?

No. The PHP manual explains that PHP code is executed on the server, which sends the resulting HTML to your browser, and the browser never sees the PHP code. So PHP2Shell is a problem for the site's server. Our guide to whether visiting a hacked website can hack you covers the visitor's side.

Where Failshot fits

Failshot is second layer device security for your Mac. Your password is the first layer, and Failshot is the layer after it.

It's for the moment someone sits down at your Mac and unlocks it. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

The Mac app is a free download for macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. Failshot for Windows is coming soon.

More questions

Does Windows come with PHP?

The PHP manual's Windows pages describe getting it from the official builds, which it recommends for production use, or building PHP from source. Running php -v is the quickest way to see whether your PC has a copy.

What does (cli) mean after the version number?

It is the kind of PHP that answered. The PHP manual says -v shows the SAPI name, the interface PHP is running through, and cli is the command line version. The flaws affect PHP serving web requests, which runs through other interfaces.

Can I have more than one version of PHP installed?

Yes. php.net offers several versions for Windows, and a development tool may carry its own copy. php -v reports the copy Windows finds through your PATH, so check any other copy by its full path.

Is updating to the latest version enough?

The PHP project says only an update is a complete solution, and that the settings changes it lists reduce exposure but do not make an installation safe. On 23 October it also published an informational advisory about a further, unlikely issue, CVE-2026-115560, covered in our PHP2Shell explainer.

Sources