How to check your PHP version and patch the PHP2Shell flaw
How to check your PHP version on WordPress, shared hosting or a private server, which versions fix PHP2Shell, and what to do if you cannot update yet.
Why it matters
Updating WordPress or its plugins does not update PHP, so many site owners may think they are covered when they are not. Checking takes a few minutes.
Your PHP version number decides whether the PHP2Shell flaws can reach your website. To check your PHP version, open your hosting control panel, look in WordPress under Tools, Site Health, Info, or run php -v on your server. It takes a few minutes.
Quick answer: If your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later on the same branch, it has the official fix. Anything older needs updating. On PHP 8.1 or older there is no official PHP release, so ask your host whether it applied PHP’s source patches, and plan a move to 8.3 or newer.
PHP2Shell is the name for two critical bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a web server without logging in. PHP released fixes on 21 October 2026. For the attack reports, government warnings and how the bugs were found, read our PHP2Shell vulnerability news report.
This guide covers the practical side: finding your real version, getting the fix, and what PHP, the US Cybersecurity and Infrastructure Security Agency (CISA) and the UK’s National Cyber Security Centre (NCSC) say to do if you cannot update straight away.
Which PHP versions fix PHP2Shell?
PHP is released in branches (8.2, 8.3 and so on), and each supported branch got its own fixed release. Compare your full version number with the row for your branch. The last column matters for planning: a branch past that date gets no fixes at all, for this bug or the next one.
| Your PHP branch | Fixed version | Security fixes end |
|---|---|---|
| 8.5 | 8.5.12 | 31 Dec 2029 |
| 8.4 | 8.4.27 | 31 Dec 2028 |
| 8.3 | 8.3.36 | 31 Dec 2027 |
| 8.2 | 8.2.35 | 31 Dec 2026 |
| 7.4, 8.0, 8.1 | Source patches only, applied by your host or vendor | Already ended |
| 5.4 to 7.3 | No fix | Already ended |
Source: PHP security advisory and supported versions page; Tenable, 21 to 25 October 2026.
Every PHP branch since 5.4, released in March 2012, carries the affected code, according to Tenable and SecurityWeek. Being on an old version does not mean the bug passed you by.
Key figure: About a third of PHP websites (26.8% on PHP 7 and 7.7% on PHP 5) run versions with no official PHP2Shell release, according to W3Techs data for 25 October 2026.
Who installs the fix depends on your hosting
Shared or managed hosting. Your host runs PHP for you. You can usually see and switch the version, but the host installs the fix, and many large hosts patched their whole platforms within a day or two of the release. Wordify, a WordPress host, says it applied the fixes to every PHP version it runs, from 7.4 to 8.5.
A VPS, cloud server or dedicated server you manage. You are responsible. DigitalOcean, for example, says customers must update PHP themselves on servers they run, while it patches its fully managed products.
Docker containers. The fix arrives only when you rebuild the image with patched PHP and redeploy, DigitalOcean says. Its container registry does not patch images for you.
Updating WordPress, a theme or a security plugin does not change PHP. They run on top of it.
Four ways to check your PHP version
- Open WordPress Site Health. In the dashboard go to Tools, then Site Health, then the Info tab, and expand the Server section. The PHP version is listed there.
- Look in your control panel. In cPanel, the MultiPHP Manager page lists each domain with the PHP version it uses, and whether it inherits the server default. Other hosts have a similar PHP settings page.
- Run
php -von a server. Log in over SSH and typephp -v. Read the next section before you trust the answer. - Check the package, not only the number. On Linux, search the package changelog for the CVE numbers, as explained below.
Why php -v can give you the wrong answer
The command reports the PHP that runs in your terminal, which is not always the PHP that serves your website. Servers often have several versions installed side by side. cPanel’s MultiPHP Manager exists precisely because one account can run different PHP versions per domain, and a web server talking to PHP-FPM may use a different build from the command line.
The bigger trap is the version number itself. Linux distributions such as Debian, Ubuntu and Red Hat usually copy security fixes into the PHP version they already ship and keep its old number, so a fully patched Ubuntu server can still report a version that looks older than 8.3.36. DigitalOcean and Tenable both tell administrators to check the vendor’s security notice instead. On Debian or Ubuntu, apt changelog followed by the package name (for example php8.3-fpm) shows whether CVE-2026-109618 is mentioned; on Red Hat-style systems, rpm -q --changelog does the same job.
The reverse also happens. Hosts that patched PHP 7.4, 8.0 or 8.1 with PHP’s source patches still show the old number, Wordify notes, because no new official release exists for those branches. Only the host can tell you.
To see what your website actually runs, a page that calls phpinfo() shows the version and how PHP is connected to the web server. It also exposes your configuration to anyone who finds it, so delete it as soon as you have read it.
Getting the fix on shared hosting
Check your host’s status page or email first, then ask support directly. Questions that get useful answers:
- Is PHP on my server patched for CVE-2026-109618 and CVE-2026-109619?
- Which PHP version and package does my site run?
- If I am on PHP 7.4, 8.0 or 8.1, have you applied PHP’s source patches?
- Can I move to PHP 8.3 or newer, and is there a staging copy to test it on?
The last question is worth asking even if the answer to the first is yes. A host’s source patch for 8.1 is a one-off; the next PHP flaw may get no fix at all on that branch. Moving branches can break old plugins or themes, so test on a staging copy where you can.
Getting the fix on your own server
Update through your package manager. DigitalOcean’s guidance for Ubuntu and Debian is sudo apt update followed by sudo apt install --only-upgrade 'php*', and for Rocky, AlmaLinux and Fedora sudo dnf upgrade 'php*' once packages are out.
Then restart PHP-FPM or your web server. This step is not a formality with PHP2Shell. The second bug, CVE-2026-109619, works through stale data that survives inside a long-running PHP worker from one request to the next, according to PHP’s advisory. A worker started before the update keeps running the old code until it is restarted.
DigitalOcean flags one more trap: restoring a backup, snapshot or server image made before the fix brings vulnerable PHP back. Update again straight after any restore.
What PHP’s stopgap settings do, and what they cost
PHP’s advisory is blunt: “There are no complete mitigations, updating is the only safe choice.” Its temporary settings close particular attack paths, and each has a price.
memory_limit=-1 switches off PHP’s own memory ceiling. That sounds backwards, but CVE-2026-109618 is triggered by PHP’s handling of hitting that ceiling, so removing it removes that path. The cost is that one runaway script can now eat the server’s memory, which is why PHP pairs this with a container or cgroup memory limit that kills only the offending worker, and warns against the older RLIMIT_AS and RLIMIT_DATA limits. It also says to set the value so applications cannot override it, for example with php_admin_value in the PHP-FPM pool.
post_max_size caps how much data a single request can send. PHP suggests 8M where no uploads are needed and 32M where they are, with upload_max_filesize kept below it, plus request limits at the web server or proxy.
session.upload_progress.enabled=0 turns off a feature that writes the progress of file uploads into the user’s session while the upload is still arriving. Few sites use it, and it is the setting that matters most in practice: security firm Hadrian said most of the exploitation it saw abused the session upload-progress path. The cost is that upload progress bars built on this feature stop working.
On PHP 8.5, PHP also suggests fatal_error_backtraces=0. And it adds a detail many guides skip: hiding error messages does not help. The fix is to remove the invalid or deprecated settings that make PHP emit those diagnostics on every request.
What to do: Put these settings in php.ini, the PHP-FPM pool or the web server configuration, then restart every PHP worker. PHP says
.user.inifiles andini_set()in code do not work for this.
On shared hosting these settings are the host’s job, which is one more reason to contact them.
When going offline is the right call
The official advice escalates in steps. The NCSC says that if you cannot update, use PHP’s temporary settings; if those would take too long, consider taking the system offline until it is fixed. CISA is stricter: anyone who cannot update immediately, or who still runs PHP 8.1 or older, should take PHP systems offline until they are patched or upgraded. It adds that a web application firewall may give some protection in the meantime.
Read that second point carefully if you are on 7.4, 8.0 or 8.1 with a host that applied source patches. CISA’s wording draws the line at the version, not at whether a backport exists, and it treats those branches as unsupported.
Advice that sounds right but is not
“Turn on maintenance mode.” A WordPress maintenance-mode plugin still runs on PHP, and PHP says that with Apache’s mod_php a demonstrated exploit fires before any application code runs. Going offline means stopping the site at the server or hosting level.
“Only old versions are affected.” Every branch from 5.4 to 8.5 had the bug. Up-to-date 8.4 sites were exposed until 8.4.27.
“Update WordPress and you’re done.” WordPress, plugins and themes sit on top of PHP and cannot replace it.
“Patch the website and stop there.” The NCSC tells organizations to look for PHP inside other software and appliances that bundle it. On a typical server that includes database tools such as phpMyAdmin and admin panels, which DigitalOcean lists among the things to inventory.
Checking whether someone got in first
Security firms reported exploit attempts within hours of the fix, and Amazon said its decoy servers recorded one on 17 October, four days before disclosure. Updating stops new break-ins. It does nothing about a backdoor planted before the update.
Watch for: PHP worker processes starting command shells or downloading tools, which CISA lists as a warning sign. Amazon advises reviewing logs back to 17 October. The NCSC says to look for backdoors before or while patching, and to call in an incident response firm if you are not confident doing it yourself.
PHP flagged a third, lower-risk issue on 23 October, CVE-2026-115560, which the 21 October releases do not fix. It only affects applications that change PHP’s session serializer setting while running, and PHP’s suggested setting until its next regular release is the same one as above: session.upload_progress.enabled=0.
If you run PHP 8.2, the date to put in your calendar is 31 December 2026. After that, the next critical PHP flaw will have no official fix on your branch.
