SiteGround PHP version: how to check it and SiteGround's PHP2Shell status

Is my SiteGround site affected by PHP2Shell?

A SiteGround site is affected by PHP2Shell if it runs a PHP build older than the fixed release for its branch. PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, so it concerns any PHP site, including WordPress, not one host in particular. On SiteGround, SiteGround installs and runs PHP, so the fix comes from SiteGround. Your part is to confirm which version your site actually runs and compare it with these fixed releases:

The PHP2Shell checker explains how to read the result.

Has SiteGround patched PHP for PHP2Shell?

SiteGround says its servers were protected before PHP published the fix, and that patched PHP builds are rolling out in batches. We couldn’t confirm that the rollout was complete as of 22 Oct 2026.

• Before the release (21 October 2026): SiteGround’s blog post SiteGround moves early to protect customers ahead of critical PHP security release (last updated 11:30 UTC) says its security team rolled out server-level mitigation rules on all servers and disabled the affected functionality on all supported PHP versions. It tells customers they don’t need to update anything or change their PHP version.
• Same day on X: SiteGround’s official account posted the same security update at 12:37 UTC.
• After the release: At about 16:00 UTC, SiteGround replied to customers on X that updates were in progress, that 8.3.36 was available on most of its servers, and that package upgrades are deployed in staged maintenance batches (SiteGround reply on X).

SiteGround has not said publicly which other branches are done. Mitigation rules lower exposure while builds roll out, but PHP states that only an update is a complete solution.

How do I check my PHP version on SiteGround?

You check the PHP version in Site Tools. According to SiteGround’s help article What Is Managed PHP Service and How to Enable It?:

1. Log in to your SiteGround account and open the Websites tab.
2. Choose your website and click Site Tools.
3. Go to Devs → PHP Manager.
4. Read the current setting under PHP Manager → PHP Version.

To see the exact build, not just the branch, check what the website itself reports. In WordPress that is Tools → Site Health → Info → Server. The PHP version checker explains what the number means.

How do I switch to a fixed PHP version on SiteGround?

On SiteGround you don’t install a patched build yourself: SiteGround updates the builds on its servers, and you choose which version your site uses. To change it, open Devs → PHP Manager, click the pencil icon next to “Change PHP version”, select an option and click Confirm (SiteGround help).

SiteGround offers two modes. With Managed PHP, SiteGround picks the version and upgrades it over time. With manual selection, your site stays on the version you chose until you change it. For PHP2Shell, being on a supported branch (8.2 to 8.5) that SiteGround has rebuilt matters more than which branch you pick. Back up and test on staging before moving to a different branch.

What about WordPress sites on SiteGround?

WordPress sites on SiteGround get the PHP2Shell fix only through PHP. Updating WordPress, themes or plugins does not fix it. After SiteGround’s rollout, open Tools → Site Health → Info → Server on each site and compare the PHP version with the table above. Sites in one account can use different PHP versions, so check each one. More detail: PHP2Shell and WordPress.

What should I ask SiteGround support?

Ask SiteGround support only if your site still shows a version below the fixed release once the staged rollout should have reached your server. Ask:

1. Which exact PHP build your site runs.
2. Whether it includes the fix for CVE-2026-109618 and CVE-2026-109619.
3. Whether PHP workers were restarted after the update.
4. If not yet, when your server’s maintenance batch is scheduled.

A ready-made message is on the PHP2Shell patch page. Open tickets only from inside your SiteGround account, and ignore emails “from SiteGround” that ask you to log in through a link.

What if my SiteGround site runs old PHP?

Older PHP is the hardest case on any host. PHP publishes no new releases for 8.1 and older, only minimal source patches for 7.4, 8.0 and 8.1. SiteGround’s post mentions mitigations on “all supported PHP versions” without listing them. We couldn’t confirm whether SiteGround ships patched builds for older branches as of 22 Oct 2026. A number like 7.4.33 can’t prove either way, so ask support, and plan a move to a supported branch: see PHP end of life.