What does the PHP version checker ask for?
Five things, and “I don’t know” is always an option:
| Field | What to enter | Where to find it |
|---|---|---|
| PHP version | The full version, such as 8.3 plus its patch number | WordPress Site Health or your hosting control panel |
| How PHP runs | PHP-FPM, Apache mod_php, CGI/LiteSpeed/FrankenPHP, or command line only | “PHP SAPI” in WordPress Site Health, or your host |
| Installed from | php.net release or official Docker image, an OS package (Ubuntu, Debian), a hosting control panel, or built from source | Your host or server admin |
| Distribution and package version | For Ubuntu or Debian packages only: the release and the full package version | Your package manager on the server |
| Temporary mitigation | Whether a stopgap such as session.upload_progress.enabled=0 is in place | Your host or server admin |
What results can the PHP version checker give?
One of four verdicts, based only on what you enter:
| Result | What it means |
|---|---|
| In the affected range | This PHP is older than the first fixed release for its branch. Update it. |
| Matches a fixed release | The version or package is at or above the fix. Restart PHP and check every site. |
| Check your vendor’s patch | The PHP comes from a distribution or custom build where the fix may be backported, and the details entered aren’t enough to confirm it. |
| Can’t tell yet | The version format, branch or setup isn’t enough to decide. |
A temporary mitigation is shown as a separate note and never turns a result into “fixed”. No result says whether a site was hacked in the past.
Where do I find the PHP version to enter?
In WordPress, open Tools → Site Health → Info → Server and read “PHP version” and “PHP SAPI”. In a hosting control panel, open the PHP settings for your domain. On a server or in a container, php -v shows the command-line PHP of that specific host or container, which can differ from the PHP your website serves. The check PHP version guide covers each method.
Why does the checker ask how PHP runs?
Because PHP2Shell is about PHP serving web requests. PHP’s advisory names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, and rates mod_php highest risk. A version read with php -v may not be the PHP your website uses, so if you choose “command line only”, the checker notes that the result doesn’t confirm the website.
Why does it ask for the distribution and package version?
Ubuntu, Debian and other distributions patch PHP in their own packages and keep the old upstream number. A fixed Ubuntu or Debian package can look older than 8.3.36 or 8.4.27 while containing the fix. With the release and full package version, the checker compares them against the vendor records below. Only rows marked “Fixed” have a confirmed fixed package version; for the others, the result is “check your vendor’s patch”.
| Vendor | Release | Package | Fixed package version | Status |
|---|---|---|---|---|
| Ubuntu | 22.04 | php8.1 | 8.1.2-1ubuntu2.28 | Fixed |
| Ubuntu | 24.04 | php8.3 | 8.3.6-0ubuntu0.24.04.13 | Fixed |
| Ubuntu | 26.04 | php8.5 | 8.5.4-0ubuntu1.5 | Fixed |
| Ubuntu | 26.10 | php8.5 | 8.5.9-0ubuntu2.1 | Fixed |
| Debian | 13 | php8.4 | 8.4.27-1~deb13u1 | Fixed |
| Docker Official Images | — | php | — | Not verified |
| 宝塔 | — | PHP | — | Not verified |
| XServer | — | PHP | — | Not verified |
| ConoHa WING | — | PHP | — | Not verified |
| ロリポップ！ | — | PHP | — | Not verified |
| 1Panel | — | 1panel/php | — | Not verified |
Checked between 21 Oct 2026 and 22 Oct 2026.
If your release or package isn’t listed, the result is “check your vendor’s patch”, not “affected”.
Can the checker scan my website by URL?
No. Many sites hide their PHP version, and some headers report the wrong one. We also don’t send requests to servers we don’t own. A URL scanner would give false comfort; the version and setup you look up yourself give a real answer.
Is anything I enter sent or stored?
No. The verdict is calculated in your browser. Nothing is sent to us or put in the page address, so a shared link never contains your details. See the privacy page.
Does one result cover my whole website?
It covers the one PHP instance you looked up. Sites with several domains, worker pools, containers or servers can run different PHP versions. Check each one, and check again after you update and restart PHP.
What should I do with the result?
- In the affected range: follow the PHP2Shell patch guide.
- Check your vendor’s patch: compare your package with your distribution’s notice, see update PHP on Ubuntu.
- PHP 7.4, 8.0 or 8.1: read PHP end of life and PHP2Shell.
- Worried about past intrusion: use the check if your website is hacked guide.
Back to the PHP2Shell checker overview.
Which sources does the checker use?
The fixed releases come from PHP’s advisories; vendor package versions come from Ubuntu and Debian security notices. Facts were checked on 22 Oct 2026.
- The PHP Group: security advisory
- GitHub advisory: RCE via OOM corruption
- GitHub advisory: RCE via stale global state
- PHP manual: php_sapi_name
- WordPress.org: Site Health screen
- Canonical: Ubuntu security notice
- Debian: security announcement
Sources
The core facts on this page (fixed versions, CVE details, vendor packages and agency warnings) come from official sources. Research, news and community posts are labelled as such.
- Security advisory: Critical remote code execution vulnerabilities, update nowOfficial The PHP Group
- RCE via OOM corruptionOfficial The PHP Group
- RCE via stale global stateOfficial The PHP Group
- php_sapi_nameOfficial The PHP Group
- Site Health screenOfficial WordPress.org
- USN-8948-1: PHP vulnerabilitiesVendor Canonical
- DSA-6574-1 php8.4 security updateVendor Debian Security Team