Hostinger PHP version: how to check it and Hostinger's PHP2Shell status

Is my Hostinger site affected by PHP2Shell?

A Hostinger site is affected by PHP2Shell if its PHP build is older than the fixed release for its branch and no other protection covers it. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. It affects PHP sites everywhere, not one host. On Hostinger’s managed hosting plans Hostinger installs PHP; on a VPS, you do. The fixed releases are:

The PHP2Shell checker explains how to read your version.

Has Hostinger patched PHP for PHP2Shell?

Hostinger says it is rolling out patched PHP across its managed hosting and that no action is needed on non-VPS plans. We couldn’t confirm that every server was finished as of 22 Oct 2026.

• Status page (21 October 2026, 17:44 UTC): In PHP Security Update Across Managed Hosting Plans, Hostinger said its tests found the platform not vulnerable to PHP2Shell, that it added an extra layer of protection, and that it would roll out patched PHP versions anyway. No client action required.
• Status page (19:12 UTC): Hostinger said the update was complete on Agency Hosting and continuing on the remaining managed hosting servers.
• Blog (21 October 2026): Hostinger deploys protections against php2shell PHP vulnerabilities lists the measures: firewall and ModSecurity rules in deny mode, session.upload_progress turned off on LiteSpeed, PHP Selector, cPanel PHP-FPM setups and phpMyAdmin, and rejection of malformed upload requests. It says patched versions were rolled out and customers were emailed.

VPS plans are different. Hostinger’s blog says the server-level protections don’t apply to VPS, because VPS customers manage PHP themselves. If you run a VPS, update PHP yourself (Ubuntu guide); stopgaps are on the workaround page.

How do I check my PHP version on Hostinger?

You find the PHP version in hPanel’s PHP Configuration page. Hostinger’s help article How to change the PHP version of your Hostinger hosting plan gives the path:

1. Go to Websites in hPanel.
2. Click Dashboard next to the website.
3. In the sidebar, click PHP Configuration.

That page shows the selected branch. For the exact build, check what the site reports; in WordPress, Tools → Site Health → Info → Server. The PHP version checker explains the number.

How do I switch to a fixed PHP version on Hostinger?

On managed plans you don’t install the fixed build; Hostinger does. You choose the branch. On the PHP Configuration page, select the version and click Update; Hostinger’s article says the change applies within a couple of minutes (Hostinger help).

Two details from that article matter:

• The setting applies to all websites on the hosting plan, except sites built with Hostinger AI Builder.
• New sites can choose PHP 8.2 to 8.5. Versions 8.1 and below can’t be selected in the dashboard.

Back up and check theme and plugin compatibility before moving to a newer branch. Hostinger’s blog notes you can switch back within the same login session if something breaks.

What about WordPress sites on Hostinger?

WordPress sites on Hostinger are fixed through PHP, not through WordPress. Updating WordPress, themes or plugins does not fix PHP2Shell. After the rollout, open Tools → Site Health → Info → Server and compare the PHP version with the table above. See PHP2Shell and WordPress.

What should I ask Hostinger support?

Contact Hostinger support if your managed site still reports a version below the fixed release after the rollout. Ask which exact PHP build your site runs, whether it includes the fix for CVE-2026-109618 and CVE-2026-109619, whether PHP workers were restarted, and when your server is scheduled if it isn’t done. A ready-made message is on the PHP2Shell patch page. Use the support chat inside hPanel, not links in unexpected emails.

What if my Hostinger site runs old PHP?

Older PHP depends on Hostinger’s own builds. PHP publishes no new releases for 8.1 and older, only minimal source patches for 7.4, 8.0 and 8.1. Hostinger’s blog says sites on older versions stay covered by the same protections, that its PHP vendor committed to patched builds for every version from 5.2 to 8.5 on Web, Cloud and cPanel hosting, and that Agency hosting runs patched builds. We couldn’t confirm those builds were deployed as of 22 Oct 2026. PHP’s announcement also notes that PHP 8.2 reaches end of life on 31 December 2026, so plan an upgrade: PHP end of life.