Is My Website Affected by php2shell? A Quick Check

Is my website affected by php2shell?

Your site is affected if it runs on PHP and the server's PHP version has not been updated since October 21, 2026. Most WordPress sites run on PHP. The check takes about five minutes and needs no technical skill: find your PHP version, compare it with the fixed versions, and ask your host to confirm.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per the PHP team.

The PHP team shipped minimal source backports for 7.4, 8.0 and 8.1 because of how severe the flaws are, but those versions no longer get regular updates. Moving to a supported branch is the safer path, and your host or developer can tell you which one fits your site. For background on the flaw, read php2shell: What the PHP Flaw Means for Your Website.

How do I find my PHP version with the free checker?

Enter your website address into our free PHP version checker. It reports what version your site appears to run and whether that version has the fix. It is the fastest route, but some hosts hide the version, so treat a blank result as "unknown," not "safe."

If the tool shows a number below the fixed versions above, or any version starting with 7, 5 or 8.1, plan an update. If it shows nothing, move to the next step and look in your hosting account.

How do I check the PHP version in my hosting panel?

Log in to your hosting account and look for a PHP setting. The name varies by host, but the page almost always shows the version number and lets you change it. If you cannot find it in two or three minutes, skip to the three questions below.

• • cPanel: open MultiPHP Manager. Your domain is listed with its PHP version.
• • Plesk: open your domain, then PHP Settings. The version is in a drop-down.
• • Managed WordPress hosts: look in the site dashboard under Tools, Settings or Server. Many show the PHP version and a switch.
• • WordPress itself: in the admin area, go to Tools, then Site Health, then Info, then Server.

Writing the number down is enough. A version like 8.3.30 is lower than 8.3.36, so it still needs the update, even though it begins with 8.3.

What three questions should I ask my developer or host?

Send these three questions by email so you have the answers in writing. They are precise enough that a vague reply stands out. A good host or developer can answer all three in a few lines, usually within a business day.

• • "What exact PHP version is my site running right now?"
• • "Has it been updated to a release that fixes CVE-2026-109618 and CVE-2026-109619? If so, on what date?"
• • "If I am on PHP 8.1 or older, what is the plan and the date to move to a supported version?"

If the host says patching is your job, as some cloud platforms do, ask who on your side will do it. AWS Lightsail, for example, leaves patching of existing instances to the customer.

What are signs that a site has been compromised?

Signs include pages or links you did not create, visitors being sent to other sites, unfamiliar admin users, and security warnings from your host or browser. None of these proves an attack, and many sites show none. Absence of signs does not prove a site is clean.

Look for:

• • New admin accounts in WordPress that nobody on your team created.
• • Strange pages, often in another language, or spammy links in search results for your business name.
• • Visitors redirected to unrelated sites, especially from mobile.
• • Unexpected files in your site folders, or a sudden spike in server use.
• • Your host emailing about malware, or a browser warning on your site.

Security firms have tracked a large volume of site infections in general. GoDaddy's annual report counted 834,661 infected sites in 2025, with malware, search spam and malicious redirects the most common types (GoDaddy report). Those figures are not specific to php2shell.

When should I get help?

Get help if your site runs PHP 8.1 or older, if the host cannot confirm the patch, if you see any sign of compromise, or if the site handles payments or patient information. Do not wait on an answer you cannot get. A short call can settle which case you are in.

If you suspect a compromise, change passwords for hosting and admin accounts, and ask your host to preserve its logs before anyone cleans anything. Then contact us. Our PHP upgrade service handles the version move, and our WordPress security service handles the review of an existing WordPress site. To discuss your situation, book a call.

Next step

Run the PHP version checker, write down the number, and send the three questions to your host today.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.