21 October 2026 · 3 min read · Marketing Scan
Editorially updated:
This article was translated from Dutch.
Short answer: find your PHP version in your hosting panel, in WordPress under Tools > Site Health > Info > Server, or ask your host. Since the PHP flaw of 21 October 2026, only 8.2.35, 8.3.36, 8.4.27, 8.5.12 and later within those branches are safe.
Few business owners know their PHP version, normally with no reason to. After php2shell, that number suddenly matters most. Here is how to find it.
Log into your host's customer area and open website management. Look for 'PHP version', 'PHP settings' or 'PHP Selector'. In cPanel, it is often Select PHP Version or MultiPHP Manager; in Plesk, PHP settings.
You usually see the branch, for example 8.3. The precise patch, 8.3.36, may appear on a separate information page. Ask if absent.
Open Tools > Site Health, the Info tab and Server. 'PHP version' displays the full number. This is quickest if you have WordPress login access.
Some servers include PHP's version in public responses. The free Marketing Scan PHP check reads this through an ordinary homepage request. It shows PHP usage, the visible version and whether it contains the fix.
If no version is revealed, the check says so. That is good security practice, but you must then use method 1, 2 or 4.
The most reliable route. Ask: 'What exact PHP version does our website run, and has it been updated for CVE-2026-109618 and CVE-2026-109619?' A good host replies the same day with a version.
With server access, php -v returns command-line PHP's version. The web server may use another version. A temporary phpinfo() file shows the actual web version; delete it immediately afterwards because it reveals extensive information to attackers.
A site is built, delivered and left untouched for years. Hosts keep servers running but do not automatically switch PHP branches because old plugins or custom code could break. Nobody takes responsibility, leaving PHP 7.4 long after updates end.
php2shell exposes this painfully: Tenable confirms no fix for PHP 8.1 or earlier. Users now face a larger upgrade under pressure, with greater breakage risk.
Agree who monitors PHP and upgrades to a supported branch at least annually. That is an hour's work, not a new project.
php.net and Help Net Security identify these fixed versions:
For the future, choose an actively supported branch so the next flaw also receives an immediate update.
Use your hosting panel, WordPress under Tools, Site Health, Info, Server, the free marketingscan.be/en/php-lek check, or ask your host.
Following php2shell in October 2026: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later in those branches. PHP 8.1 and earlier receive no fix.
No. PHP 7.4 has received no security updates for years and is vulnerable to php2shell. Upgrade to at least PHP 8.2.
Many hosts deliberately hide it to reduce attacker information. That is good, but you must establish it another way, such as asking your host.
How does a marketing scan work? Audit methodology
Create a free account. Save your website in your dashboard and follow its score and improvements in one place.
Create your free accountEvery WordPress website uses PHP and is affected by php2shell. Follow these steps to keep your website, plugins and online shop secure after the flaw.
· 4 min read
Updated:
Find out in four steps whether your website is vulnerable to the October 2026 PHP flaw, without technical knowledge and without putting your site at risk.
· 4 min read
Updated:
Ready-to-copy emails about the PHP vulnerability for your host, developer and follow-up, plus how to recognise whether their answer is specific enough.
· 4 min read
Updated:
Do you know which channels generate customers? Record sources during lead follow-up and use actual figures to guide your small-business marketing budget.
· 4 min read
Updated:
Smartschool, DPG Media and hospitals went offline over the PHP flaw. Decide whether you should too and understand what maintenance mode does and does not do.
· 4 min read
Updated:
WordPress 7.2 Beta 2 arrived on October 27. Test forms, mobile journeys and measurement on a staging site rather than putting your live website at risk.
· 4 min read