Check your PHP version
How to check your PHP version
Your hosting control panel, WordPress Site Health (Tools > Site Health > Info > Server) or the command php -v will each tell you which PHP version you run. Note the full number, not only the branch, then compare it with the fixed releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Last reviewed against php.net and the cPanel, Plesk and WordPress documentation.
Choose a method
Five ways to find it, depending on your access
The question that matters is which PHP your website runs, and not every method answers it. Start with the first one you have access to.
| Method | What you need | Shows the website's PHP? |
|---|---|---|
| Hosting control panel | A cPanel or Plesk login | Yes, domain by domain |
| WordPress Site Health | The WordPress dashboard | Yes |
| php -v on the command line | A shell on the server | Not always |
| A temporary version or phpinfo() file | Permission to upload files | Yes |
| HTTP response headers | Nothing beyond curl or a browser | Only if the server sends it |
Method 1
In your hosting control panel
On shared and reseller hosting, the control panel is the quickest route, and it reports the version each website uses rather than whatever the command line happens to run.
cPanel
Open MultiPHP Manager, which cPanel files under Software. It lists each domain on your account with the PHP version it currently uses. A domain marked Inherited follows the server's default version rather than one chosen for it.
If the panel does not appear, your host may have switched the feature off for your account. If a version you want is missing, it is either not installed on the server or not offered to you.
WHM (server administrators)
In WHM, go to Home > Software > MultiPHP Manager. The System Settings tab holds the server-wide default, and the User Domain Settings tab shows the version and PHP-FPM status of every domain on the server.
Plesk
Go to Websites & Domains, find the domain and click PHP. The page shows the selected version and handler. Plesk also prints the version next to the PHP icon on the domain's card, so you can often read it without opening the settings at all.
If the panel shows only a branch
A label such as "PHP 8.3" tells you the branch, not whether you have 8.3.36 or something older. When the panel stops at the branch, use Site Health or a temporary version file to read the full number, or ask your host.
Method 2
In WordPress Site Health
WordPress has a built-in report that reads the version straight from PHP. Because the report is produced by an ordinary page request, it shows the PHP that actually serves your site.
How to update PHP in WordPress- 1. In the dashboard, open Tools > Site Health.
- 2. Switch to the Info tab. It only displays information, so nothing you click here changes your site.
- 3. Expand Server. The PHP version row gives the full version string, followed by a note on 64-bit support. The PHP SAPI row tells you how PHP is connected to the web server.
Method 3
On the command line, and why it can disagree
With a shell on the server, one command prints the version and the server API of the PHP binary on your path:
php -vphp -irunsphpinfo()and prints the full report as plain text.php --inilists the configuration files that this PHP binary loaded.
Why the command line can report a different version
- It is a different server API. The command-line build is its own SAPI. On Ubuntu, for example, it ships as a separate package (
php8.3-cli) from the PHP-FPM build (php8.3-fpm) and the Apache module (libapache2-mod-php8.3). - Several branches can be installed at once. cPanel can give each domain its own version, and third-party repositories such as Remi's and Ondřej Surý's are built to install branches side by side. The
phpcommand may point at a different branch from the one serving your site. - Running processes keep old code. After a package update, the files on disk are new, but PHP-FPM, Apache and LiteSpeed processes that were already running carry on with the old build until they are restarted.
Treat php -v as the
version of the command-line tool. For the website, use the control
panel, Site Health or a version file.
Method 4
A temporary version file, or phpinfo()
If you can upload files but have no panel or shell, a small PHP file placed in the website's folder and opened in a browser shows the version the web server runs.
Preferred: print only the version
This one line outputs the PHP_VERSION constant and nothing else.
<?php echo PHP_VERSION;Full report: phpinfo()
Shows the version along with the php.ini location, loaded extensions and every configuration value. Useful for troubleshooting, and far more revealing.
<?php phpinfo();Delete the file as soon as you have read it
A phpinfo() page lays out your server's paths, PHP configuration, environment variables and the headers, cookies and other data of the request that opened it. Anything your hosting stores in environment variables is visible to whoever loads the page. Give the file a name nobody would guess, read the version, then remove it. Never leave either file on a live site.
Method 5
In the response headers, if the server sends them
Request only the headers of a page on your site and look for an
X-Powered-By
line such as PHP/8.3.36.
curl -I https://www.example.com/
PHP adds that header only while the expose_php
setting is on. The production php.ini that PHP ships leaves it on,
but the setting can be turned off in php.ini, so a missing header
proves nothing either way. When the header is present, it repeats the
same version string PHP reports internally, so the backport caveat
below still applies.
Next step
Is my version fixed?
For PHP2Shell (CVE-2026-109618 and CVE-2026-109619), find your branch and compare the full number with the fixed release. The fixed release or anything later on the same branch carries the PHP project's fix. Anything lower is vulnerable, unless it is a distribution package with the fix backported.
| Branch | Fixed in |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 (branch supported until 31 December 2026) |
| PHP 8.1, 8.0, 7.4 | No release from the PHP project |
| PHP 7.3 and older | None |
The full picture
Who is exposed, the interim settings and the alerts from the NCSC and CISA.
PHP2Shell explained
Below the fixed release?
Answer a few questions about your setup to decide whether to patch today, mitigate or take the site offline until it is fixed.
Should I take my website offline?
On PHP 8.1 or older?
The PHP project no longer fixes these branches. See the support dates and your options.
PHP end of life datesDistribution packages can look older than they are. Linux distributions often patch the PHP version their release shipped with. Ubuntu 24.04's fixed package is version 8.3.6-0ubuntu0.24.04.13: built on PHP 8.3.6, far below 8.3.36, and still listed by Ubuntu as fixed for both CVEs. Check your distribution's tracker, not the number. How to read a backported version.
On Windows, the number does not change. The PHP project's 26 October 2026 Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) update the bundled Brotli library for CVE-2026-111497 while keeping the same runtime version, so PHP reports the same number before and after. Check which package you installed. Updating PHP on Windows and IIS.
Source: the PHP project's 21 October 2026 security releases and Ubuntu's CVE-2026-109618 page.
Quick answers
PHP version questions, answered
How do I check my PHP version?
Use whichever access you have. In cPanel open MultiPHP Manager, in Plesk open the domain's PHP settings, in WordPress go to Tools > Site Health > Info > Server, or run php -v on the server. Then compare the full number with the fixed release for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Why does php -v show a different version from my website?
Because the command line and the web server do not have to use the same PHP. The command-line build is a separate server API, often packaged separately, and many servers have several PHP branches installed side by side. A running PHP-FPM or Apache process also keeps the old code until it is restarted. For the website's version, use Site Health, a temporary version file or the control panel.
Is it safe to leave a phpinfo() file on my site?
No. phpinfo() prints your server's paths, configuration, environment variables and details of the request that loaded it. Anyone who finds the file can read all of that. Create it, read the version, and delete it straight away, or use a one-line file that prints only PHP_VERSION instead.
What does PHP SAPI mean in Site Health?
It is the server API: the way PHP is plugged into your web server. Common values include fpm-fcgi (PHP-FPM), apache2handler (Apache with mod_php), litespeed and cgi-fcgi. The PHP project rates the PHP2Shell risk highest for Apache with mod_php, so this line is worth noting alongside the version.
My version is below 8.3.36 but my host says I am patched. Who is right?
Possibly both. Linux distributions often fix security flaws in the PHP version their release shipped with, so a patched package can show an older upstream number. Ubuntu 24.04's fixed package, for example, is built on PHP 8.3.6. Ask your host which package and advisory they installed, or check the distribution's security tracker yourself.
Can I check the PHP version of a website I do not run?
Only if its server chooses to announce it in an X-Powered-By response header, and that header can be switched off. Even when it is there, a distribution package can carry a fix under an older-looking number, so the header alone cannot tell you whether the site is exposed. The site's owner or host is the only reliable source.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.