Kinsta PHP version: how to check it and Kinsta's PHP2Shell patch rollout

Is my Kinsta site affected by PHP2Shell?

A Kinsta site is affected by PHP2Shell if its PHP build is older than the fixed release for its branch. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. It concerns PHP sites everywhere, not one host. On Kinsta, PHP is managed at platform level, so Kinsta installs the fixed builds and you confirm the result. The fixed releases are:

The PHP2Shell checker explains how to read your version.

Has Kinsta patched PHP for PHP2Shell?

Kinsta says patched builds for every PHP version it runs are rolling out, but its status incident was still open, so we couldn’t confirm completion as of 22 Oct 2026. Kinsta’s status page incident PHP Security Vulnerability Update says:

• 21 October 2026, 19:04 UTC: PHP is managed at platform level on Kinsta, and fixes deploy automatically once validated. Cloudflare protections built for these vulnerabilities were mitigating attacks across all sites. Patched PHP 8.3 and 8.5 were validated and rolling out. No action required.
• 20:20 to 22:06 UTC: Rollout widened, version by version, to 8.0, 7.4 and 8.1.
• 23:25 UTC: Patches rolling out for 8.5, 8.4, 8.3, 8.2, 8.1, 8.0 and 7.4. Cloudflare firewall mitigations and local configuration changes stay in place for all sites, patched or not, until further notice.

Firewall rules reduce exposure while builds roll out, but PHP states that only an update is a complete solution.

How do I check my PHP version on Kinsta?

You check the PHP version in MyKinsta. Kinsta’s help article Restart and Update PHP gives the path:

1. Log in to MyKinsta, go to Sites and select the site.
2. Go to Tools.
3. Look at PHP settings.

That shows the selected branch. For the exact build, check what the site reports; in WordPress, Tools → Site Health → Info → Server. The PHP version checker explains the number.

How do I switch to a fixed PHP version on Kinsta?

On Kinsta you don’t install the fixed build; Kinsta does. You pick the branch. According to Kinsta’s help article:

• One site: Sites → select the site → Tools → under PHP settings, click Change → choose a PHP version and turn Automatic PHP Updates on or off.
• Several sites (staging included): Sites → tick the sites → Actions → PHP settings → Change PHP settings.

Kinsta’s 19:04 UTC status update added that sites already on 8.3 or 8.5 could apply the patch immediately by switching to a lower PHP version and then back. Back up and test on staging before moving to a different branch.

What about WordPress sites on Kinsta?

WordPress sites on Kinsta get the PHP2Shell fix only through PHP. Updating WordPress, themes or plugins doesn’t fix it. After the rollout, open Tools → Site Health → Info → Server on each site and compare the PHP version with the table above. See PHP2Shell and WordPress.

What should I ask Kinsta support?

Contact Kinsta support if a site still reports a version below the fixed release once Kinsta closes its incident. Ask:

1. Which exact PHP build the site runs.
2. Whether it includes the fix for CVE-2026-109618 and CVE-2026-109619.
3. Whether PHP was restarted after the update.
4. For 7.4, 8.0 or 8.1, how you can tell the patched build apart.

A ready-made message is on the PHP2Shell patch page. Open tickets from inside MyKinsta, not from links in unexpected emails.

What if my Kinsta site runs old PHP?

Kinsta lists 7.4, 8.0 and 8.1 in its rollout, but PHP itself publishes no new releases for these branches, only minimal source patches. A patched 7.4 build may therefore show the same version number as an unpatched one, so the number alone can’t confirm the fix; ask Kinsta. Kinsta’s help article also notes that choosing an LTS PHP version turns off automatic PHP updates. Plan a move to a supported branch: PHP end of life.