Bluehost PHP version: how to check it and Bluehost's PHP2Shell status

Is my Bluehost site affected by PHP2Shell?

A Bluehost site is affected by PHP2Shell if it runs a PHP build older than the fixed release for its branch and Bluehost hasn’t patched that server yet. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, so it concerns PHP sites everywhere, including WordPress. On Bluehost shared hosting, Bluehost installs PHP; you choose the version and confirm the result. The fixed releases are:

The PHP2Shell checker explains how to read your version.

Has Bluehost patched PHP for PHP2Shell?

Bluehost says it has patched most of its servers and is rolling out the rest, so we couldn’t confirm completion as of 22 Oct 2026. Bluehost’s status page notice PHP Updates, posted 21 October 2026, says:

• 12:18 (US Eastern, as posted): Bluehost applied the latest PHP security patches on most servers and is rolling them out to the rest. It also added interim mitigations for the CVEs. No impact on websites or email is expected, but upload file size limits may apply.
• 13:00: Bluehost reminded customers that keeping their environment up to date is one of the best protections, linking guides for WordPress and for VPS and dedicated servers.

The notice doesn’t name individual products or PHP versions. Mitigations reduce exposure, but PHP states that only an update is a complete solution.

How do I check my PHP version on Bluehost?

You check the PHP version in the Bluehost Portal or in cPanel. Bluehost’s shared hosting help article What is the Latest Supported PHP Version? gives two routes:

Websites tab: log in to the Bluehost Portal → Websites → Manage Site next to the site → Advanced tab → PHP Version tile.

cPanel: Bluehost Portal → Hosting → My Plans → cPanel → Software → MultiPHP Manager, which lists each domain with its PHP version.

On Bluehost Agency hosting the path differs: Websites → Manage Site, and the version is on the Overview tab (Bluehost help). For the exact build, check WordPress: Tools → Site Health → Info → Server. The PHP version checker explains the number.

How do I switch to a fixed PHP version on Bluehost?

On shared hosting Bluehost installs the fixed builds; you choose the branch. According to Bluehost’s help article:

• Websites tab: in the PHP Version tile, click Change Version, choose a version from the drop-down and click Apply.
• MultiPHP Manager: select the domains, open the PHP Version drop-down at the top right, choose a version and click Apply.

On Agency hosting, go to the Settings tab, click Change PHP Version, select the version and click Apply (Bluehost help). Bluehost advises testing compatibility first and not skipping versions; back up before changing branch. VPS and dedicated customers are pointed to a separate Bluehost article; ask Bluehost whether you or Bluehost updates PHP on your server.

What about WordPress sites on Bluehost?

WordPress sites on Bluehost get the PHP2Shell fix only through PHP. Updating WordPress, themes or plugins doesn’t fix it. After the rollout, open Tools → Site Health → Info → Server on each site and compare the PHP version with the table above. See PHP2Shell and WordPress.

What should I ask Bluehost support?

Contact Bluehost support if your site still reports a version below the fixed release after the rollout, or if you’re on a VPS or dedicated server and unsure who patches it. Ask which exact PHP build the site runs, whether it includes the fix for CVE-2026-109618 and CVE-2026-109619, whether PHP was restarted, and when your server will be done. A ready-made message is on the PHP2Shell patch page. Contact support from your Bluehost account, not through links in unexpected emails.

What if my Bluehost site runs old PHP?

Bluehost’s Agency hosting article lists PHP 8.1 and older as deprecated, its shared hosting article gives 8.1 as the minimum on shared servers, and its status notice doesn’t say whether older builds get the fix. PHP publishes no new releases for 8.1 and older, only minimal source patches for 7.4, 8.0 and 8.1. We couldn’t confirm Bluehost’s status for these branches as of 22 Oct 2026. Move to 8.2 or newer: see PHP end of life.