PHP2Shell: practical guide

How to check your website's PHP version (and whether it fixes PHP2Shell)

Reviewed by the Apex broking team · Last reviewed 2026-10-22

To check your website's PHP version, look in your hosting control panel or, in WordPress, go to Tools > Site Health > Info > Server. It matters because the PHP2Shell flaws are fixed in specific PHP releases, and cyber insurers commonly ask how quickly you apply critical patches.

Part of: PHP2Shell and cyber insurance

Am I affected by PHP2Shell?

Last updated 22 October 2026. If your website runs on PHP and has not been updated since 21 October 2026, assume it is affected until you have checked. PHP2Shell is the name security researchers gave to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 and both allowing unauthenticated remote code execution.

According to the PHP project's security advisory, all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the risk highest for mod_php. That covers most WordPress, Drupal, Joomla and Magento sites, because they all depend on the PHP version installed on the server.

On 21 October 2026 the UK's National Cyber Security Centre published an alert asking organisations to identify systems running any version of PHP, starting with internet-facing ones, and to prepare to update immediately. As of 21 to 22 October 2026, several security firms reported exploitation attempts. For the bigger picture, including what it means for your cover, see our PHP2Shell and cyber insurance guide.

How to check your website's PHP version: six ways

1. Your hosting control panel

Most UK hosts show the PHP version for each site in the control panel, and many let you change it there. Look for a section called something like PHP settings, PHP version or software. If several sites share one account, check each one, because they can run different versions.

2. WordPress Site Health

In the WordPress dashboard, go to Tools > Site Health > Info and open the Server section. WordPress.org's own security post of 21 October 2026 points site owners to this screen. The Site Health documentation explains the Info tab.

3. The X-Powered-By response header

PHP can announce itself in an HTTP response header such as X-Powered-By: PHP/8.4.27. The expose_php setting controls this. You can see response headers in your browser's developer tools (the Network tab). Treat it as a hint, not proof: many servers hide the header, a missing header tells you nothing, and the number shown may not reflect fixes a Linux distribution has backported.

4. A phpinfo() page

A file containing <?php phpinfo(); ?> uploaded to your site shows the PHP version near the top. The PHP manual says it also outputs configuration, paths, environment variables and HTTP headers. That is useful to an attacker, so delete the file as soon as you have the answer. Never leave it public.

5. The command line

If you or your developer have server access, php -v prints the version, as shown in the PHP manual. Note that it reports the command-line (cli) build. A server can have more than one PHP version installed, so confirm the website itself uses the same one.

6. Ask your host or IT provider in writing

This is often the most reliable route, especially on shared or managed hosting, where the host controls the PHP build. Ask:

• Which PHP version and handler does my site use?
• Is it a fixed release, or a distribution package with backported fixes for CVE-2026-109618 and CVE-2026-109619?
• When was the fix applied?
• Have you checked for signs of compromise from before the fix?

Keep the reply. It is a simple record of what you did, which can help if an insurer later asks.

What PHP version fixes CVE-2026-109618?

The PHP project released fixed versions on 21 October 2026. The same releases fix CVE-2026-109619.

The Linux distribution caveat. The advisory says Linux distributions and LTS vendors received the patches in advance and asks users to check their vendor for updated packages. A distribution package can therefore carry the fix while still reporting an older-looking version number, such as 8.1. The reverse also matters: a number that looks current is only safe if it is at or above the fixed release in its branch. If your host uses distribution packages, ask them to confirm the package includes the two CVE fixes.

Interim settings are not a fix. The PHP project lists temporary configuration changes, but says they reduce exposure to specific attack paths and do not make an installation safe. Updating is the only complete answer.

Does a patched PHP version mean my site is safe?

It means the two known flaws are closed from the moment the update went in. It does not prove that nobody exploited them earlier. Security firms reported exploitation attempts around the time the fix was released (21 to 22 October 2026), and a successful attacker can leave behind files or accounts that survive a PHP update.

So after patching, ask your developer or host whether they have looked for signs of compromise, such as new admin users, unknown PHP files in upload folders, changed .htaccess files or unexpected scheduled tasks. Our PHP2Shell and WordPress guide lists what to ask about. If something looks wrong, our guide to the first 72 hours of a cyber incident covers notifying your insurer and the ICO.

If your site is run by someone else, you are still the business whose customers and data are at stake. Our page on cyber insurance when your website is hosted explains why hosting does not move that risk off your books.

Why insurers ask about patching

Cyber insurers price and accept risks partly on how well a business keeps its systems up to date. A cyber proposal form commonly asks how quickly you apply critical security patches, whether you run unsupported software, and who manages your website and servers. Your answers form part of the information the insurer relies on, so they need to be accurate.

Some policies also contain conditions or exclusions about failing to patch known vulnerabilities or running unsupported software. Whether a claim is affected depends on the exact policy wording, what was reasonable in the time available, and whether the issue contributed to the loss. We explain how these clauses commonly work in does cyber insurance cover unpatched vulnerabilities?

Patching evidence also helps at renewal. Under the NCSC's Cyber Essentials requirements, critical or high-risk security updates must be applied within 14 days of release, and hosted and cloud services cannot be excluded from scope. Insurers commonly ask whether you hold Cyber Essentials. A dated note of when PHP was checked and updated, and by whom, is worth keeping alongside your policy documents.

What to do next

1. Check the PHP version for every site you run, using one of the methods above.
2. If it is below the fixed release for its branch, ask your host or developer to update, or to confirm a patched distribution package.
3. If you are on PHP 8.1 or older, plan an upgrade to a supported branch. PHP 8.2 support ends on 31 December 2026.
4. Ask whether anyone has checked for signs of compromise from before the fix.
5. Keep written confirmation of what was done and when.
6. Read your cyber policy's conditions on security, patching and notification.

Apex is an independent broker, not an IT security firm, so we do not patch or scan websites. We can check your current cyber policy's conditions on patching, security and notification; help Apex clients notify their insurer quickly and correctly if something has happened; and arrange cyber insurance if you have none, through our cyber quote form. If your renewal is coming up, we also offer a free renewal second opinion.

Sources

• PHP: Security advisory, 21 October 2026
• NCSC: Critical security issue affecting PHP (alert, 21 October 2026)
• WordPress.org News: Critical PHP Security Release (21 October 2026)
• WordPress.org: Site Health screen
• PHP Manual: phpinfo()
• PHP Manual: core php.ini directives (expose_php)
• PHP Manual: command line options
• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3

Frequently asked

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.