If you manage a website, you have probably heard something about the php2shell vulnerability by now. It is a pair of actively exploited PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow attackers to execute remote commands on servers that have not been patched. Both CVEs appear in the CISA Known Exploited Vulnerabilities (KEV) catalog [3], which means the threat is documented and real, not theoretical.
Before you can do anything about it, though, you need one straightforward piece of information: which version of PHP is your website running right now? If you want to know whether you are affected by PHP2Shell, the answer lives in that number.
This guide covers five ways to check the PHP version on your site, from the simplest hosting-panel click to a command-line query. None of these methods require you to be a developer. The whole process takes about two minutes per site.
Key Takeaways
Running through five methods manually for ten sites is slow, and it still leaves gaps. Staging environments, subdomains, and forgotten servers rarely make the list.
Log in to your hosting panel (cPanel MultiPHP Manager or Plesk), open WordPress under Tools > Site Health > Info > Server, or run php -v in a terminal. If the version you see is below 8.2.35, 8.3.36, 8.4.27, or 8.5.12, your site is vulnerable to PHP2Shell and needs to be patched immediately.
This is the easiest starting point for most people, and it works regardless of what software powers your website.
If your host uses cPanel:
If your host uses Plesk:
Not sure which panel your host provides? Look at the URL you land on after logging in. cPanel typically connects on port 2083. Plesk addresses usually contain the word “plesk” in the URL path. If neither applies, a quick message to your hosting support team will get you the answer within minutes.
WordPress ships with a built-in PHP version checker. No plugin installation, no FTP access, no technical knowledge required.
The number you see is the PHP version running that specific WordPress installation. A value of 8.3.35, for example, falls below the patched build of 8.3.36 and is vulnerable.
One important limitation: Site Health only covers the single WordPress install you are logged into. If you have a staging environment, a subdomain install, or multiple sites under the same hosting account, each one needs to be checked separately. If that sounds like a lot of manual work, a dedicated PHP version scan covers all your properties in a single pass.
The phpinfo() function outputs a full page of server details, including the exact PHP version. This method works on any PHP-powered site, not just WordPress.
Step 1: Create the file. Open a plain text editor (Notepad on Windows or TextEdit on Mac). Type exactly this, and nothing else:
<?php phpinfo(); ?>
Save the file as phpinfo.php.
Step 2: Upload it. Using FTP or your hosting panel’s file manager, upload phpinfo.php to the root folder of your website. That is the same directory that holds your index.php or index.html.
Step 3: View the output. In your browser, navigate to https://yourdomain.com/phpinfo.php. The first large heading on the page will read something like PHP Version 8.3.35.
Step 4: Delete the file immediately. This step is not optional or something to come back to later. A phpinfo.php file left in place hands anyone on the internet a complete readout of your server configuration, which is precisely the kind of information attackers use during reconnaissance. Return to your file manager or FTP client and delete phpinfo.php before you do anything else.
If you manage a VPS, a dedicated server, or a shared hosting account that includes SSH access, this is the fastest check available.
Open a terminal and run:
php -v
The output will look something like this:
PHP 8.3.35 (cli) (built: Oct 15 2026 11:30:00)
Copyright (c) The PHP Group
The version number appears immediately after “PHP” on the first line. Write it down and compare it against the lookup table in the next section.
If you manage several servers, run this command on each one. PHP versions vary across machines even within the same organization, and one outdated server is all an attacker needs.
Every time a browser loads a page, the server sends back a set of response headers along with the content. Some servers include a header called X-Powered-By that identifies the PHP version in plain text.
How to check it:
A quick note on reliability: many hosting providers and WordPress security plugins deliberately suppress or overwrite the X-Powered-By header to reduce the information available to attackers. If you do not see it, that is not confirmation of any specific version. It simply means this method will not work for your server. Fall back to one of the earlier methods in this guide.
Use this table to determine your current exposure. The fixed builds come directly from the official PHP security advisory [2].
| PHP Branch | Vulnerable If Your Version Is Below | Fixed (Safe) Build | What to Do |
| PHP 8.5 | 8.5.12 | 8.5.12 | Update to 8.5.12 |
| PHP 8.4 | 8.4.27 | 8.4.27 | Update to 8.4.27 |
| PHP 8.3 | 8.3.36 | 8.3.36 | Update to 8.3.36 |
| PHP 8.2 | 8.2.35 | 8.2.35 | Update to 8.2.35 |
| PHP 8.1 | All versions | No patch available | Upgrade to a supported branch |
| PHP 7.x and below | All versions | No patch available | Upgrade to a supported branch |
PHP 8.1 has passed its end-of-life date and no longer receives security patches of any kind. PHP 7.x has been out of support for longer still. If your site runs either of those versions, you are not dealing with a single fixable flaw. You are carrying a legacy PHP vulnerability that requires moving to a supported PHP branch before anything else can be addressed.
For sites running PHP 8.2 through 8.5, a patch exists. Once you have confirmed your version, follow the how to update PHP version steps for your specific hosting environment. After patching, your web server must be restarted for the fix to take effect [1]. This is not automatic. Confirm with your host that the restart has occurred, then re-check your version using any of the five methods above
SureShield’s PHP Scan finds every PHP endpoint you own, including the ones you have not thought about in two years.
Once you have confirmed a vulnerable version, the next step is contacting your web host and requesting an update. Here is a message you can copy and paste directly. Fill in your current version before sending.
Subject: PHP Security Update Request (PHP2Shell / CVE-2026-109618 / CVE-2026-109619)
Hi,
I am writing to request an urgent PHP update for my hosting account. My site is currently running PHP [INSERT YOUR CURRENT VERSION HERE], which is below the patched builds released to address the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619).
The fixed versions per the official PHP security advisory are:
Please update my account to the appropriate fixed build as soon as possible. Could you also confirm whether a server restart will be required after the update, and advise if there will be any expected downtime?
Thank you.
After your host confirms the update, re-check your PHP version using any of the five methods earlier in this post. The confirmation takes about two minutes and tells you the patch actually landed rather than assuming it did.
For a broader look at your site’s exposure beyond PHP, you can run a complimentary external vulnerability scan through SureShield’s SecurityShield TVM. It is a useful starting point for understanding your full risk posture. Persistent or complex vulnerability backlogs are also worth addressing through a structured threat and vulnerability management program rather than individual one-off fixes.
Related reading: How does PHP2Shell actually behave inside a WordPress site compared to Drupal or Magento? The wp2shell vs php2shell breakdown covers the platform-by-platform differences.
