Free PHP version checker: is your website exposed to PHP2Shell?
Two critical security flaws in PHP, the software behind most websites, were fixed on 21 October 2026. The UK's National Cyber Security Centre has told every organisation running PHP to update. Enter your website below and we'll tell you in seconds whether yours needs attention. It's free.
Contacting your website
Which PHP versions are safe today?
This table is built from PHP's own release feed and security advisories, so it changes as new releases come out. Find your version in your result above, or ask your host which one you're on.
| PHP version | Latest secure release | Security support ends | Status |
|---|---|---|---|
| PHP 8.5 | 8.5.12 | 31 December 2029 | Supported |
| PHP 8.4 | 8.4.27 | 31 December 2028 | Supported |
| PHP 8.3 | 8.3.36 | 31 December 2027 | Supported |
| PHP 8.2 | 8.2.35 | 31 December 2026 | Ending soon |
| PHP 8.1 | None (last was 8.1.34) | 31 December 2025 | Unsupported |
| PHP 8.0 | None (last was 8.0.30) | 26 November 2023 | Unsupported |
| PHP 7.4 | None (last was 7.4.33) | 28 November 2022 | Unsupported |
Last updated 22 October 2026, 04:15 (UK time). Sources: php.net releases, PHP security advisories and endoflife.date.
What is PHP2Shell?
PHP2Shell is the nickname for two security flaws in PHP: CVE-2026-109618 and CVE-2026-109619. Both are rated critical, with a severity score of 9.2 out of 10. Both let an attacker run their own code on your web server, and neither needs a login to do it.
The PHP project released fixes on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older did not get an official release. The PHP security team published source patches for 7.4, 8.0 and 8.1, but most hosts won't apply those, so sites on those versions need upgrading to a supported version.
The same day, the National Cyber Security Centre published an alert saying organisations using any version of PHP are affected and should update to the latest fixed version.
Why updating WordPress won't fix it
The flaw sits underneath WordPress, Joomla, WooCommerce and every other platform written in PHP. Updating WordPress, your theme or your plugins cannot touch it, and neither can a security plugin. The fix is a PHP update on the server, which means your hosting company or whoever manages your server has to do it.
If you're on a managed host such as WordPress.com, WP Engine or Kinsta, they usually patch PHP for every customer at once. It's still worth a quick message to confirm your site is covered.
What your result means
The checker gives one of eight results. Here's what each one tells you.
Not affected
Your site runs on a platform such as Wix, Squarespace or Shopify that looks after its own servers, or on a stack that doesn't use PHP. There's nothing for you to update.
Critical: upgrade needed
Your site shows a PHP version that no longer gets security fixes, so it won't receive the PHP2Shell fix or any future ones. Ask your host or developer to move you to a supported version, after testing the site works on it.
Update needed now
Your version is supported but older than the release that fixes a critical flaw. Ask your host to update today.
Update recommended
No critical flaws are listed for your version, but a newer release exists. Staying current is the safest choice.
Up to date
Your server shows the latest release for its version. Good news.
Runs on PHP, version hidden
Your server doesn't say which version it runs. That's good practice, but it means nobody can confirm from outside whether you're patched. In WordPress, go to Tools, then Site Health, then Info, then Server to see it yourself.
Your host manages PHP
Your site is on a managed platform that rolls out PHP updates for everyone. A quick message to confirm is still worthwhile.
We couldn't check your site
Your site didn't respond to our check, which often means bot protection. That's no bad thing. Send your host the message from your result, or ask us to check it for you.
With every PHP result: we only read what your server shares publicly. Some hosts install security fixes without changing the version number, and a hidden version proves nothing either way. Ask your host to confirm.
How to fix it
Where your site lives decides who does the update.
Managed WordPress hosting
WordPress.com, WP Engine, Kinsta, SiteGround and similar hosts patch PHP across their platform. Check your host's status page, or ask support to confirm your site has the fix.
Shared hosting with a control panel
cPanel, Plesk, hPanel, StackCP and similar panels usually have a PHP version selector. The patched release may already be there. Ask your developer before switching to a new version, because older plugins and themes can break.
Your own server or VPS
Update the PHP packages from your distribution's security repository, then restart PHP-FPM or the web server. If nobody looks after the server for you, that's the first thing to sort out.
Why this matters for your Google rankings
A hacked website rarely looks hacked to its owner. What usually happens is quieter: hidden spam pages appear, visitors get redirected to scam sites, and Google notices before you do. Google can label your site "This site may be hacked" in the search results, Chrome can show visitors a red warning page, and your rankings can drop.
Cleaning up and getting the warnings removed can take weeks. All that time, your Google Business Profile is sending customers straight to the warning. Keeping PHP patched is a lot cheaper than that.
PHP versions and end-of-life dates
Every PHP version follows the same path. It gets about two years of active support, with bug fixes and improvements. After that it gets security fixes only, currently for a further two years. Then it reaches end of life and gets nothing at all, however serious the flaw.
That's why "it still works" is not the same as "it's still safe". A site on an end-of-life version will run happily right up until someone finds a hole that will never be closed. The table above shows the dates for each version, taken from the live data, so it stays correct as versions age out.
Questions
Is this checker free?
Yes. There's no charge and no obligation.
Will the check harm my website?
No. It makes a handful of ordinary page requests, the same as a visitor's browser would, and reads what your server sends back. It never tests, probes or attacks your site.
Why can't you see my PHP version?
Many hosts hide it, and that's good practice. You can find it yourself in a couple of minutes. In WordPress, go to Tools, then Site Health, then Info, then Server. Or ask your host.
My site is on Wix, Squarespace or Shopify. Do I need to do anything?
No. Those platforms manage their own servers, so the PHP update is their job, not yours.
My host says I'm patched but the checker says update needed. Who's right?
Your host. Some hosts apply security fixes without changing the version number the server shows. The checker can only read what your server shows.
What PHP version should I be on?
A supported one, ideally the newest version your site's software has been tested with. The table above shows which versions are supported today.
Do you store my website's result?
Only privately, to send your report and to follow up if you've asked us to. We never publish results or list the sites that have been checked.
What is PHP?
PHP is the programming language that runs most of the web's websites behind the scenes, including every WordPress site. Your hosting company runs it on the server. Like any software, it needs updating when flaws are found.
Result hidden or blocked? We'll check it by hand.
Paid Ads Digital is a local SEO, Google Business Profile and paid media agency in Church Crookham, Hampshire. We work with small businesses across Hampshire and Surrey, mostly trades. If your result came back hidden or blocked, send us the address and we'll check it properly, free.
