Is My WordPress Site Affected by PHP2Shell? Check It Now

First: Does Your Site Run PHP at All?

WordPress sites always do. So do Drupal, Joomla, Magento, OpenCart and most sites that a developer "built from scratch" more than a few years ago. If the login page for your site is at /wp-admin, you are on WordPress and you can skip straight to the methods below.

Sites on Squarespace, Shopify, Wix, Webflow and Rocketspark do not run PHP that you control; the platform runs whatever it runs, and any patching is theirs to do and theirs to confirm. Static sites, which is what we build, have no PHP anywhere. If you are not sure which kind you have, the outside check in method 2 will usually tell you, and the free check at the bottom of this page always will.

Three Ways to Find the Number

Method 1: inside WordPress (2 minutes)

□Log in to your WordPress dashboard
□Tools, then Site Health, then the Info tab
□Open the Server section and read the PHP version line
□Fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. Anything else: not fixed

Method 2: from outside (1 minute)

□Open your site in Chrome, press F12, choose the Network tab and reload
□Click the first request (your page) and look under Response Headers
□An X-Powered-By line such as PHP/8.3.35 is the server announcing its version
□No PHP line means either no PHP or a host that hides it; use method 3

Method 3: ask the host (one email)

□"Which PHP version is the server for [your domain] running, and on what date was it updated for CVE-2026-109618 and CVE-2026-109619?"
□A good host replies with a version number and a date
□A reply that talks about WordPress updates has missed the point; ask again
□No reply within a working day is itself an answer about the host

Pixel art of a WordPress Site Health screen on a monitor with the Server section open and the PHP version row highlighted in yellow — Tools, Site Health, Info, Server. The PHP version line is the only one you need today.

What the Number Means

The fixes were released on 21 October 2026 as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Match your number to its branch: if you are on 8.3.something, you need 8.3.36 or higher. 8.3.35 is one short and not fixed. The same logic for 8.2, 8.4 and 8.5.

If the number starts with 8.1, 8.0 or 7, the PHP project no longer updates that version at all. Some Linux distributions and extended-support vendors have issued their own backported fixes, so ask your host whether they are using one; if they cannot name it, treat the server as unpatched and plan an upgrade. PHP 8.2 itself reaches end of life on 31 December 2026, so a server on 8.2 has a second deadline ten weeks away.

One more thing the number does not tell you: whether PHP was restarted after the update. A patched version that has not been restarted is still running the old code. That is why the email to your host asks for the date, not just the version.

If the Version Is Hidden

Managed WordPress hosts like Flywheel, WP Engine and Kinsta hide the PHP version from the outside world, and so do many well-run servers. That is good practice, not a red flag. It does mean method 2 shows you nothing, and if you cannot log in to WordPress either, method 3 is the only one left.

Send the host the question exactly as written above. The CVE numbers tell them you know what you are asking about, and asking for the date tells them you know the difference between "we have a patch" and "it is running". Most managed hosts patched within hours; the reply should be short and specific.

What If the Answer Is Bad?

Three options, in the order we would take them. First, chase the host today; a patch is a few minutes of their time. Second, if they will not or cannot, put the domain behind Cloudflare. Its free firewall has blocked PHP2Shell attack traffic for all customers since 21 October, which reduces the exposure while you sort the server out. It is not a fix, and we would say that in the same breath, but it is the best interim answer there is and it takes about twenty minutes.

Third, ask whether you want to keep doing this. A WordPress site needs this kind of attention every time PHP, WordPress, the theme or one of the plugins has a problem, which is often. The next article in this series is about what the alternative looks like, what it costs, and when it is not worth it.

The Free Check

Send us your web address through the contact page and within the hour, during working hours, you get a plain answer: PHP or not, the version the server reports, patched or not, and if not, the exact question for your host. No login needed; it is all in what the server already tells a browser. If it is patched, we say so and that is the end of it.

Key Takeaways

WordPress always runs PHP. Squarespace, Shopify, Wix and static sites do not run PHP you control.
Find the version in WordPress: Tools, Site Health, Info, Server.
Safe is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. One release short is not fixed.
PHP 8.1 and older: no fix from the PHP project. 8.2 ends on 31 December 2026.
Hidden version: email the host for the number and the date, with the CVE numbers.
Bad answer: chase, then Cloudflare as an interim step, then decide whether to keep living like this.

FAQ

How do I find out what PHP version my website uses?

Three ways. In WordPress, Tools, Site Health, Info, Server lists the PHP version. From outside, a browser's developer tools or a header checker shows an X-Powered-By header on many servers. Or ask your host, which is the only method that works when the version is hidden.

Which PHP versions are safe from PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026, and anything newer. Any earlier number in the same branch (8.3.35, say) is not fixed. PHP 8.1 and older get no fix from the PHP project.

My host hides the PHP version. Is that bad?

No, it is normal for managed WordPress hosts and a reasonable security habit. It just means the only way to know is to ask them for the version and the date they updated. A good host answers within the day.

Does updating WordPress fix PHP2Shell?

No. The holes are in PHP, the language WordPress is written in, not in WordPress itself. Updating WordPress, the theme and the plugins is still a good idea, but it does not touch this.

Can you check my site for me?

Yes, and it is free. Send the address through the contact page and within the hour (during working hours) you get a plain answer: PHP or not, the version the server reports, patched or not, and the question to send your host if it is not.