Guide · about 2 minutes

Which PHP version does my website use?

Because of the PHP2Shell security flaw, you should know right now which PHP version your website runs on. Here's how to find out, no technical knowledge needed.

As of 22 October 2026. By Markus Bruckgraber, Co-Founder, Joize FlexCo.

These PHP versions are safe

PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer are protected against PHP2Shell. PHP 8.1 and older no longer get official updates.

Find your PHP version in WordPress

The easiest way, if you can log in to WordPress.

Log in to the WordPress dashboard (usually your-company.com/wp-admin).
In the menu on the left, click Tools → Site Health.
Switch to the “Info” tab at the top.
Expand the “Server” section. It shows the PHP version, for example 8.3.36.

WordPress often shows only the main version, such as 8.3 without the last number. In that case, ask your hosting provider for the exact version.

Find your PHP version with your host, in Plesk or cPanel

Works with every CMS and shop.

Log in to your web hosting provider's customer area.
Open the settings for your domain or web space.
Look for a menu item such as “PHP”, “PHP settings” or “PHP version”. In Plesk: Websites & Domains → PHP. In cPanel: Software → MultiPHP Manager.
There you'll see the version in use, and you can usually switch to a newer one.

Here you'll usually only see the main version (8.3). Only your hosting provider knows whether the security update from 21 October is included.

Find your PHP version in Joomla, TYPO3 and Drupal

If your website runs on a different CMS.

Joomla: System → System Information. The PHP version is shown in the overview.
TYPO3: as an administrator, click the info icon (System Information) at the top right.
Drupal: Reports → Status report. The PHP version is listed in the system information section.

Check your PHP version in the browser

No login needed, but it doesn't work for every website.

Open your website in Chrome, Edge or Firefox.
Press F12 (Mac: Option + Cmd + I) and switch to the “Network” tab.
Reload the page and click the first entry at the top of the list.
Under “Response Headers”, look for “X-Powered-By”, for example PHP/8.3.12.

Many hosting providers hide this information. If it's missing, that doesn't mean PHP isn't running. Our free quick check runs this test for you automatically.

Check your PHP version via SSH

If you have SSH access to the server.

php -v shows the command-line version. The website may use a different one.
More reliable: php-fpm -v (depending on the system, e.g. php-fpm8.3 -v), or briefly upload a phpinfo() file, open it and delete it again straight away.
On Plesk, don't forget the panel itself: plesk php -v.
For Debian, Ubuntu or Red Hat packages, the distribution's security notice is what counts, not the version number. Afterwards, restart all PHP processes.

Email template for your hosting provider

Subject: PHP2Shell: Is our website protected yet?

Hello,

On 21 October 2026, the critical PHP security flaws known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) were made public.

Please confirm the following for our website [your web address]:

1. Which PHP version is currently running?
2. Has the security update from 21 October been installed (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or the matching package update)?
3. After the update, did you check for signs of a break-in (unknown files, new admin accounts, unusual errors in the logs)?

If the update can't be installed right away, please take the website offline for now or put it behind a web application firewall.

Many thanks and kind regards

Frequently asked questions

Which PHP version is safe?

PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and newer are protected against PHP2Shell. PHP 8.1 and older no longer get official updates.

I only see “8.3” without a third number. What now?

Then you only know the main version. Only your hosting provider can tell you whether the update from 21 October 2026 has been installed. Use the email template on this page to ask.

My version is lower, but my hosting provider says it's protected. Is that true?

It can be. Linux distributions such as Ubuntu and some hosting providers apply the fix without changing the version number. Ask them to confirm it in writing.

Can I change the PHP version myself?

With most hosting providers, yes, in the customer area under “PHP settings”. Make a backup first and check afterwards that the website still works properly. Old plugins sometimes can't handle newer PHP versions.