To check your PHP version in WordPress, log in to your admin dashboard, open Tools > Site Health and read the Server section of its Info tab. Your PHP version matters right now. PHP is the programming language WordPress runs on, and on October 21, 2026, fixes shipped for PHP2Shell, two critical flaws in PHP itself. Automattic warns that updating WordPress, your theme or your plugins "will not protect you on its own."
The short version
| Question | Answer |
|---|---|
| What is it? | Two flaws that let a stranger run their own code on your server without logging in (remote code execution) |
| Tracking numbers | CVE-2026-109618 and CVE-2026-109619 |
| Who is exposed? | CISA: the flaws "affect all PHP installations serving web requests" |
| When was it fixed? | October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
| Who applies the fix? | Whoever runs your server; for most small business sites, the web host |
| Is it being attacked? | Amazon's threat team: "PHP2Shell is now being broadly exploited in the wild" |
For the full story of the bug, read our explainer, what is PHP2Shell. This post covers one job: find your number and get it fixed.
What changed this week
Your site runs on a programming language called Hypertext Preprocessor (PHP). PHP sits on the server, underneath your theme and plugins. Until this week, most owners never had a reason to know which version they ran.
On October 21, the US cyber agency CISA told anyone on version 8.1 or older, or anyone who cannot update, to take those systems offline. Reuters, via The Globe and Mail, reported government sites in four countries going dark that day. The same report cites a scanning firm's count: about 1.5 million of 2.6 million hosts it checked ran a version with no fix.
So the version number is now a security question, not a settings detail.
How do I check my PHP version in the WordPress dashboard?
WordPress keeps it on the Site Health screen, which every recent install has built in. The official documentation puts that screen under Tools > Site Health > Info.
- Log in as an administrator and click Tools, then Site Health, in the left menu.
- Click the Info tab, then the arrow beside Server to open that section.
- Write down the whole version number, such as 8.3.36 rather than just 8.3.
The screen is read-only. The documentation notes that you "cannot configure any of the settings from it," so changes happen at your host.
Site Health also has a Status tab, which may say "Your site is running an outdated version of PHP." Treat that warning as a nudge. A missing warning does not mean you are safe, because the patches are one day old.
How do I check it in cPanel or my host's dashboard?
If your host gives you cPanel, open the screen called MultiPHP Manager. cPanel's documentation says its list of domains shows "the PHP version that the domain currently uses." A domain marked "Inherited" uses the server's default. On shared plans, the host still controls which patch releases are installed.
Other hosts build their own dashboards, and the menu names differ. Look for a section named after the language, or one called Server, in the site's settings. If you cannot find it in five minutes, skip the hunt and send the email below.
Many dashboards show only "8.3" without the last number. That last number is the one that tells you if the fix is in.
Which PHP versions are safe from PHP2Shell?
Each supported branch has one first fixed release, and anything newer on the same branch is fine. Support dates come from the official supported versions page.
| PHP branch | First fixed version | Security support until |
|---|---|---|
| 8.5 | 8.5.12 | December 31, 2029 |
| 8.4 | 8.4.27 | December 31, 2028 |
| 8.3 | 8.3.36 | December 31, 2027 |
| 8.2 | 8.2.35 | December 31, 2026 |
| 8.1 and older | No regular release | End of life |
Two cautions before you relax.
The number alone may not prove anything. Help Net Security reports that operating system vendors got the patches early. Some now offer "backported fixes." A backport copies the fix into an older-looking build. So a host can be patched while showing a number below the table. Only the host can confirm it.
Branch 8.2 is a short-term answer. Automattic calls 8.3 or newer the better target, since support for 8.2 ends this December. On anything older, its advice is blunt: "plan to move now." Help Net also mentions source-code backports for a few retired branches, meant for people who build the language themselves. Treat those as a developer stopgap and plan the move anyway.
Who patches PHP: me or my host?
Your hosting type decides who does the work. On most small business sites the host owns the server, and your job is to get a written confirmation.
| Hosting type | Who updates PHP | What you do |
|---|---|---|
| Shared hosting (cPanel and similar) | The host | Ask for written confirmation of the fixed version or backport |
| Managed WordPress hosting | The host | Same email; ask when the update was applied |
| VPS or cloud server you run | You or your developer | Install your vendor's updated packages and restart PHP |
| WordPress.com, WordPress VIP, WP Cloud, Pressable | Automattic | Nothing, per Automattic |
Automattic says sites on its own hosting platforms are "already protected." In its words, "There is nothing you need to do." If you are self-hosted anywhere else, the email below is your next step.
What should I ask my web host?
Ask for the exact version on your site and whether it carries the fix. Copy this, fill in the brackets, and send it to your host's support:
Subject: PHP2Shell fix for [yourdomain.com]Hi,
Please confirm, for [yourdomain.com]:
- The exact PHP version the site runs (all three numbers, e.g. 8.3.36).
- Whether that PHP build includes the fixes for CVE-2026-109618 and
CVE-2026-109619 (PHP2Shell), either as PHP 8.5.12 / 8.4.27 / 8.3.36 /
8.2.35 or newer, or as a backported fix from your Linux vendor.
- The date and time the fix was applied.
- If the site is on PHP 8.1 or older, when you can move it to 8.3 or newer.
Thank you,
[Your name]
Keep the reply. If your host answers "we are working on it," ask for a date, and read the next section.
What if I can't update PHP today?
You can lower the risk for a few days, but only the update closes the hole. Automattic puts it plainly: "These steps buy time. They are not a substitute for the update."
Put the site behind a firewall. A web application firewall filters bad requests before they reach your server. Cloudflare says its new rules run on every plan with its firewall switched on, including the free plan, with no setup needed. It also says these measures "do not replace the PHP fix."
Ask your host about interim settings. If your site takes no file uploads, Automattic suggests blocking multipart form submissions and switching off two upload settings on the server. Your host or developer makes these changes.
Skip "fix" plugins. Patchstack, a security firm that tracks plugin flaws, warns against unofficial fix plugins and snippets. A plugin runs on top of the language, so it cannot repair it.
Consider going offline. That is the US agency's guidance for systems that cannot be updated or run 8.1 or older. For a brochure site, a few dark days may cost less than a break-in.
The limits of this check
The dashboard shows the version your site sees. It cannot tell you whether a host backported the fix. It also says nothing about other software on the same account, like an old forum or a second install. Britain's national cyber agency tells organisations to look for installs they did not set up themselves. Hal Pomeranz, quoted by Help Net Security, put the wider worry simply: "So many embedded installations out there that will never be patched." We have not tested any single host's dashboard for this post, so menu names will vary.
Where we fit
We run a free site check, and we will tell you what PHP version your site runs. The sites we build do not run PHP on the server, so PHP2Shell does not reach them; they carry their own update duties. If this week has you weighing a move, read is WordPress safe after PHP2Shell, then WordPress bloat vs AI-native architecture and our WordPress to headless migration guide.