PHP checker: is your PHP version patched?

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair of critical remote-code-execution flaws in PHP, disclosed in October 2026. Fixes shipped on 21 October in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Paste your PHP version below and we'll compare it with the fixed releases.

Where do I find my PHP version?

On the server: run php -v and paste the first line. If your site runs under PHP-FPM, also check php-fpm -v (or e.g. php-fpm8.3 -v), as it can differ from the command-line PHP.
In phpinfo(): paste the “PHP Version 8.x.y” line.
From your own website: run curl -sI https://yoursite.com | grep -i -E 'x-powered-by|server', or open your browser's developer tools (Network tab) and look for the X-Powered-By response header. Many servers hide it, which is good practice, in which case use php -v.
Shared hosting: the version is usually shown in your control panel (e.g. cPanel “Select PHP Version”).

We never contact your server or test for the flaw; we only compare the version number.

Need help updating? Get in touch with Hancocks IT.