Is your website patched against PHP2Shell?
Enter your website's PHP version, or paste its response headers, and I'll tell you in plain English whether it has the fix, what to do next, and what to say to whoever looks after your site.
What PHP2Shell is, in one minute
PHP2Shell is the name for two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), the software underneath WordPress, WooCommerce, Joomla, Drupal, Magento, Laravel and most shared web hosting. Together they can let an attacker take over a web server without logging in. Fixes came out on 21 October 2026, attacks started within hours, and the NCSC has told organisations to update straight away. Read the full story and what to do.
Updating WordPress or its plugins does not fix this. PHP has to be updated on the server itself, usually by your web host.
Where to find your PHP version
- WordPress: log in, go to Tools, then Site Health, then the Info tab, and open Server. Copy the line that says PHP version.
- cPanel hosting: look for MultiPHP Manager or Select PHP Version. This shows the series (like 8.3), so ask your host for the full number too.
- Plesk hosting: open Websites & Domains, then PHP for your site.
- Your website's headers: open your website in Chrome or Edge, press F12, choose Network, reload the page, click the first item and look under Response Headers for
X-Powered-By. You can paste the whole block of headers in. - If you manage the server: run
curl -sI https://yourwebsite.co.uk | grep -i x-powered-by, or check a phpinfo page.php -vshows the command line version, which isn't always the one serving your website.
If you can't find it, that's fine and very common. Many hosts hide the version on purpose. Choose I don't know my version above and you'll get a ready-made message to send your host or developer.
Versions that fix PHP2Shell
| PHP series | Fixed from |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | No official fix |
Ubuntu, cPanel and other providers also publish their own fixed builds, which can keep an older-looking version number. When that's the case, the checker will say it can't tell from the number alone, and your host can confirm.
How to apply the fix
If a hosting company looks after your server, this is their job: send them the message the checker gives you. If you or your developer manage the server, here's the short version. Take a backup first.
Ubuntu or Debian
Run sudo apt update && sudo apt upgrade, then restart PHP and the web server, for example sudo systemctl restart php8.3-fpm and sudo systemctl restart apache2 or nginx. If you use the Ondřej Surý PHP packages, they update the same way.
Red Hat, AlmaLinux or Rocky Linux
Run sudo dnf update 'php*', then sudo systemctl restart php-fpm and sudo systemctl restart httpd or nginx.
cPanel and WHM
Install the updated EasyApache PHP packages, either through WHM's update tools or with yum update 'ea-php*' (or dnf). Switching PHP version in MultiPHP Manager doesn't install the fix. The packages themselves need updating.
Plesk
Go to Tools & Settings, then Updates, and install the updated PHP components, or update the system packages if Plesk uses your operating system's PHP.
Windows (IIS) or Docker
On Windows, download the latest build of your PHP series from the official PHP for Windows site and replace your PHP folder, keeping your php.ini. With Docker, pull the latest official php image for your series, rebuild and redeploy.
Then check the version again, ideally from your website itself (WordPress Site Health or a phpinfo page you delete afterwards), and run it through the checker above. If you're on PHP 8.1 or older, there's no update to install: the fix is moving to PHP 8.2 or newer.
Why the checker doesn't scan your website for you
Honestly, because it can't do it reliably. Browsers stop one website reading another's technical details, and plenty of servers hide their PHP version anyway. A tool that guessed would sometimes tell you you're safe when you're not. So this one works from the version you find, and when it can't tell, it says so and tells you what to do next.
PHP2Shell questions
Why can't you just scan my website?
Browsers deliberately stop one website from reading the technical details of another, so a tool running in your browser can't look up your site's PHP version for you. Many hosts also hide the version on purpose. Rather than guess, this tool works from the version you find, and tells you plainly when it can't tell.
My website uses WordPress. Does updating WordPress fix PHP2Shell?
No. PHP is the software underneath WordPress, so it has to be updated on the web server itself, usually by your web host. Keep WordPress and plugins updated too, but that alone won't fix PHP2Shell.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later versions in the same series. Some providers, such as Ubuntu and cPanel, publish their own fixed builds. PHP 8.1 and older are no longer supported and have no official fix.
My version number looks old, but my host says it's patched. Who's right?
Possibly both. Linux distributions such as Ubuntu and Red Hat often add security fixes to an older version without changing the main number. Ask your host to confirm in writing that the PHP2Shell fixes are included in the build your site uses.
We're patched now. Are we safe?
Patching stops new attacks using these flaws, but attacks started on 21 October 2026, before many sites were updated. If your site was unpatched after that, check for signs it was already attacked, such as admin users you don't recognise, changed files or strange redirects.
Do you see what I paste into the checker?
No. The check runs entirely in your browser and nothing you type or paste is sent anywhere, including to fromIT.
Not sure where your website stands?
Book a 30 minute call and I'll help you work out what your site runs on, who looks after it, and whether it's patched. If you think it's already been attacked, that's a cyber incident and I can help with that too.