How to check if your site is exposed to PHP2Shell

PHP2Shell is a flaw in PHP itself, so the question is simple: which PHP version does your server run, and is it one of the fixed ones?

Step 1: find your PHP version. - Hosting control panel: most panels (cPanel, Plesk and similar) show it in a section called PHP settings or Select PHP version. - WordPress: go to Tools, then Site Health, then the Info tab, and open Server. It lists the PHP version. - Ask your host. One line is enough: "Which PHP version runs my site, and does it include the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619)?" - Managed hosting: many managed hosts update PHP for you. Do not assume it is done. Ask them to confirm the exact version.

Step 2: compare it with the safe versions. - Safe: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer in the same branch. - At risk: anything older in those branches. - PHP 8.1, 8.0 and 7.4 only got minimal source backports. Ask your host whether they are applied, and plan a move to 8.2 or newer. - PHP 7.3 and older: there is no fix. Upgrade, or take the site offline.

Some hosts patch PHP without changing the version number. If your version looks old but your host says it is patched, ask them to confirm it in writing.

Step 3: run a check. Our free checker at /check looks at what your server shows any visitor, including a PHP version in its headers. If your server hides its version (good practice), the checker cannot see it, so steps 1 and 2 still matter.

Remember: updating WordPress, plugins or themes does not fix PHP2Shell. Only upgrading PHP on the server does. If you cannot upgrade soon, consider taking the site offline until you can.