WP Engine PHP version: how to check it and WP Engine's PHP2Shell status

Is my WP Engine site affected by PHP2Shell?

A WP Engine site is affected by PHP2Shell if its environment runs a PHP build older than the fixed release for its branch. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, the language that WordPress runs on. WP Engine installs and runs PHP for its customers, so WP Engine deploys the fix; you confirm the result. The fixed releases are:

The PHP2Shell checker explains how to read your version.

Has WP Engine patched PHP for PHP2Shell?

WP Engine says it is deploying patches across its platform with mitigations in place, but its incident was still open, so we couldn’t confirm completion as of 22 Oct 2026. WP Engine’s status page incident PHP Security Update says:

• 21 October 2026, 13:40 UTC: WP Engine’s security teams had been monitoring and taking mitigating actions, and protective mitigations were deployed at the CDN layer via Cloudflare and Fastly. Updates would roll out across all customer platforms as soon as possible.
• 17:30 UTC: Patches were being deployed. Mitigations active at the CDN layer and the hosting layer.
• 21:52 UTC: Patch deployment continuing. All PHP versions running on the platform will be updated, including 7.4, 8.2, 8.4 and 8.5.

The updates do not ask customers to take any action. Mitigations reduce exposure while patches roll out, but PHP states that only an update is a complete solution.

How do I check my PHP version on WP Engine?

You check the PHP version per environment in the User Portal. WP Engine’s help article How to Upgrade Your PHP Version describes the PHP Selector:

1. In the User Portal, go to the Sites page.
2. Select the environment name.
3. In the Updates section, find PHP. The number shown is the environment’s current version.

Production, staging and development are separate environments, so check each one. For the exact build, check what WordPress reports in Tools → Site Health → Info → Server. The PHP version checker explains the number.

How do I switch to a fixed PHP version on WP Engine?

On WP Engine you don’t install the fixed build; WP Engine does. You choose the branch. Per WP Engine’s help article, click the PHP version number in the Updates section, select a new PHP version and click Confirm.

For PHP2Shell, staying on a branch WP Engine is patching matters more than jumping to the newest branch. If you do change branch, test on a staging environment first and back up production.

What about WordPress sites on WP Engine?

WordPress sites on WP Engine get the PHP2Shell fix only through PHP. Updating WordPress, themes or plugins doesn’t fix it, and PHP2Shell is a different issue from the WordPress-core flaw called wp2shell. After WP Engine finishes, compare the PHP version in Site Health with the table above. See PHP2Shell and WordPress.

What should I ask WP Engine support?

Contact WP Engine support if an environment still reports a version below the fixed release after WP Engine marks its incident resolved. Ask:

1. Which exact PHP build the environment runs.
2. Whether it includes the fix for CVE-2026-109618 and CVE-2026-109619.
3. Whether PHP was restarted after the update.
4. For PHP 7.4, how you can tell the patched build from an unpatched one.

A ready-made message is on the PHP2Shell patch page. Contact support from inside the User Portal, not through links in unexpected emails.

What if my WP Engine site runs old PHP?

WP Engine lists 7.4 among the versions it will update, but PHP itself publishes no new 7.4 release, only minimal source patches for 7.4, 8.0 and 8.1. A patched 7.4 build may show the same version number as an unpatched one, so the number can’t confirm the fix on its own; ask WP Engine. Then plan a move to a supported branch: see PHP end of life.