How to check your website's PHP version, and whether it has the PHP2Shell fix

The short answer

The quickest way to check a WordPress site is inside your dashboard: Tools > Site Health > Info > Server, where WordPress shows the PHP version your site is running. Compare it with the table below. If you see 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a higher number on the same branch, your PHP has the PHP2Shell fix from the PHP project. If you see anything lower, ask your host whether they installed a vendor build with the fix for CVE-2026-109618 and CVE-2026-109619.

The most common mistake we expect this week is a site owner checking one site, seeing a good number, and forgetting the staging copy, the old shop subdomain or the second business site on the same account. Each one runs its own PHP setting.

How to read the number

A PHP version has three parts. In 8.3.36, "8.3" is the branch and "36" is the patch release. Compare the patch release only against the fixed version for your branch.

Worked example. Site Health shows PHP 8.3.35. The branch is 8.3 and the fixed release is 8.3.36. Your number is one below, so treat the site as unpatched until your host says otherwise. A second site on the same account shows 8.1.31: there is no official fix for 8.1 at all, so you need a written confirmation of a backport, and an upgrade to 8.3 or newer on your list.

Check in WordPress

1. Log in to your WordPress dashboard as an administrator.
2. Open Tools, then Site Health.
3. Click the Info tab and expand Server.
4. Read the line for the PHP version. Write it down with the site address and today's date.

The Status tab on the same screen may warn that your PHP is outdated. That warning compares you with WordPress's recommended version, not with this week's security fix, so use the table above instead. WordPress's support handbook describes Site Health as the built in place to check software versions and required server features.

Check in your hosting control panel

Most hosts show the PHP version for each domain in their control panel. In cPanel, hosts usually put it under a tool called MultiPHP Manager or Select PHP Version, depending on how the server is set up. Managed WordPress hosts tend to show it on each site's overview or settings page. Names differ between hosts, so if you cannot find it in two minutes, ask support; it is a routine question.

Two things to watch for in the panel:

• Each domain can have its own version. Check every domain and subdomain in the list, not just the main one.
• The panel may show only the branch. A setting that says "PHP 8.3" tells you the branch, not the patch release. Use Site Health or ask your host for the full number.

Sites that are not WordPress

Drupal, Joomla and Magento also run on PHP and each shows server information in its admin area. If your site uses something custom, your developer can tell you the version in a minute from the server itself.

You may see advice to upload a small file that prints all PHP settings. It works, but that page also shows details about your server to anyone who finds it. If your developer uses this method, the file should be removed right after reading it. For most owners, asking the host is simpler and safer.

If you use a fully hosted builder where you never manage hosting, there is no PHP version for you to check. The platform runs its own servers.

Why a lower number can still be safe

PHP's advisory says Linux distributions and long term support vendors received the patches in advance, and that some of them provide fixes for PHP 8.1 and older. These vendor builds often keep the original version number and add the fix underneath. InMotion Hosting, for example, published that its shared and WordPress hosting covers PHP versions back to 5.2 through its vendor, CloudLinux, while some of its self managed server setups get no fix for older versions.

That is why the number alone cannot settle it for older versions. The right question for your host is: "Does the PHP build serving my site include the fix for CVE-2026-109618 and CVE-2026-109619, and when was it installed?" Our emails to send your host and web designer include this wording.

Red flags in your host's reply

• "WordPress is up to date" with no PHP version mentioned. WordPress updates do not fix this.
• "We are monitoring the situation" with no date for the patch.
• "You are on PHP 7.4, which is still supported by us" with no mention of a backported fix for these two CVEs.
• A reply that covers your main site but not the other domains you listed.

If you get one of these, reply once asking for the specific build and install date. If the host cannot give it, read how to take a site offline without hurting your Google ranking.

Our take

One WordPress site on a well known host: check Site Health, compare with the table, and send one email if the number is below the fixed release. That is the whole job.

Several sites or subdomains: make a simple list with the address, host, PHP version and date checked. You will need it again on December 31, 2026, when PHP 8.2 stops getting official fixes.

On PHP 8.1 or older: even with a backported fix, you are now relying on your host for every future PHP flaw. We would schedule the move to 8.3 or newer this month, after testing a staging copy, rather than wait for the next emergency.

When the pick would change: if your host publishes a status page listing every server as patched, a screenshot of that page is as good as an email for your records.

Sources

• PHP: Security advisory, critical remote code execution vulnerabilities (October 21, 2026)
• PHP: Supported versions
• Canadian Centre for Cyber Security: AL26-026 Critical vulnerabilities impacting PHP
• WordPress Support Handbook: Troubleshooting using the Health Check
• InMotion Hosting: Critical PHP security release, October 21, 2026