Is Your Website Affected by the Latest PHP Vulnerability? How to Check

The latest PHP vulnerabilities, known as PHP2Shell, could allow attackers to execute code on affected web servers. Website owners should check which PHP version their hosting environment uses, confirm whether the relevant security patches have been installed, and investigate suspicious activity if the website may have been exposed. A website working normally does not necessarily mean it is secure.

What Is the Latest PHP Vulnerability?

PHP2Shell refers to two critical PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these flaws could allow an unauthenticated attacker to execute code on an affected server.

On 21 October 2026, the PHP project released security updates addressing both vulnerabilities. The official PHP advisory identifies PHP installations serving web requests as potentially affected, including configurations using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Another vulnerability, CVE-2026-115560, was reported on 23 October 2026. It is a separate issue and is not addressed by the 21 October updates. Its exploitation depends on a specific combination of PHP configuration and application behaviour.

Website owners should therefore check the relevant advisories rather than assume that one update resolves every PHP security issue.

Which Websites and PHP Applications Could Be Affected?

Any website running an affected PHP installation may need attention. This includes WordPress websites, WooCommerce stores, Laravel applications, CodeIgniter projects and custom PHP websites.

Your website needs a closer check if:

• You do not know which PHP version your hosting provider uses.
• Your hosting provider has not confirmed whether the relevant security patches are installed.
• Your website runs an older or unsupported PHP version.
• You manage a VPS, dedicated server, cloud server or container running PHP.
• Your website accepts public requests and processes them through an affected PHP installation.

Using PHP does not automatically mean your website has been hacked. The actual risk depends on the PHP installation, patch status and relevant configuration. Checking for a vulnerability is also different from investigating whether an attacker has already accessed your server.

Which PHP Versions Need Security Updates?

The PHP project released the following fixed versions for the PHP2Shell vulnerabilities.

If your installation is running an earlier version in one of these branches, confirm its patch status and arrange the appropriate update.

PHP 8.1 and older no longer receive updates from the main PHP project. Some operating system and long-term support vendors may provide security fixes separately, including backported fixes. Contact your hosting provider or package vendor to verify whether the specific vulnerabilities have been addressed.

For the latest details, consult the official PHP security advisories.

How Can You Check Whether Your Website Is Running an Affected PHP Version?

The first step is to identify the PHP version actually handling requests for your website.

Step 1: Check Your Hosting Control Panel

Log in to your hosting dashboard and look for options such as MultiPHP Manager, PHP Selector or PHP Configuration. The name varies by hosting provider.

Check the PHP version assigned to your domain. If you host several websites, check each relevant domain separately.

Keep in mind that scheduled tasks, command-line scripts and containers may use different PHP installations from the one serving normal website requests.

Step 2: Check the PHP Version Through SSH

If you have authorised SSH access, a server administrator can run this command:

php -v

It displays the PHP version associated with the command-line environment.

However, this command does not necessarily show the version used by the live website. The administrator must also verify the web-facing PHP installation, such as the PHP-FPM service or the PHP module configured for the web server.

Step 3: Confirm That the Security Patch Is Installed

Compare your installation with the relevant official PHP advisory and your hosting provider’s security notices.

Some vendors backport security fixes to their packages, so the displayed version number alone may not tell the whole story. Ask your provider to confirm that CVE-2026-109618 and CVE-2026-109619 have been addressed in the PHP installation serving your website.

You can also consult the Canadian Centre for Cyber Security advisory for additional guidance.

What If Your Website Does Not Display Its PHP Version?

A website that hides its PHP version can still be vulnerable. Hiding version information does not replace installing a security patch.

If you cannot access your server, follow these steps:

1. Check the PHP configuration in your hosting dashboard.
2. Contact your hosting provider and request confirmation of the PHP version used for web requests.
3. Ask whether the relevant security fixes have been installed.
4. Confirm whether additional action is needed for CVE-2026-115560.

Avoid uploading a publicly accessible phpinfo() file just to check the PHP version. Such a file can reveal sensitive server configuration details. If a diagnostic script is necessary, have an authorised administrator use it safely and remove it immediately afterwards.

What Should You Ask Your Hosting Provider?

You can send the following message:

Hello, I would like to confirm whether my website is affected by the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Could you confirm the PHP version used for web requests, whether the relevant security patches have been applied, and whether any additional action is required for CVE-2026-115560? Please also confirm whether any vendor-provided backported fixes are being used.

How Can You Check Whether Your WordPress Website Is Affected?

Updating WordPress does not automatically update the PHP runtime installed on your hosting server. Both need to be checked separately.

For your WordPress website:

• Check Site Health: Open Tools, then Site Health, and review the available server information.
• Check your hosting dashboard: Confirm the PHP version assigned to the website.
• Contact your host: Ask whether the web-facing PHP installation has received the appropriate security fixes.
• Update WordPress components: Keep WordPress core, themes and plugins maintained because they can have separate vulnerabilities.

If your website uses an older PHP version, check compatibility and take a backup before planning an update. Work with your hosting provider or developer to address security risks without unnecessarily disrupting the website.

How Can You Tell Whether Your Website Has Already Been Hacked?

Running a vulnerable PHP version indicates potential exposure, not confirmed compromise. Similarly, installing a patch does not prove that an attacker never accessed the server.

Warning signs worth investigating include:

• Unrecognised administrator accounts or unexpected permission changes.
• Unknown files in website directories, especially recently modified executable files.
• Unexpected redirects, spam pages or unfamiliar website content.
• Suspicious PHP or web server processes.
• Unexplained changes to server configuration or scheduled tasks.
• Unusual requests or command execution recorded in available logs.

These signs are not conclusive by themselves, and some compromises may leave few obvious symptoms.

If you suspect an intrusion, preserve relevant logs and arrange a server-level investigation. Do not assume that installing a security patch automatically removes malicious files or backdoors that may already be present.

What Should You Do If Your PHP Version Is Vulnerable?

If your checks indicate that your website may be affected, prioritise remediation.

1. Contact your hosting provider or server administrator. Confirm which PHP installation is affected and which fixes are available.
2. Apply the appropriate security update. Use a supported fixed release or a verified vendor-provided patch suitable for your environment.
3. Check all relevant installations. Include web-facing PHP, scheduled tasks, containers and other environments serving the application.
4. Investigate possible compromise. Review relevant logs and system activity if the server was exposed before patching.
5. Verify the result. Confirm that the active web runtime is patched and test important website functions.

For CVE-2026-115560, consult the Canadian Centre for Cyber Security advisory for current guidance. It describes a configuration-specific mitigation involving the PHP session upload progress feature. Do not change server settings without confirming that the mitigation is appropriate for your environment.

When Should You Get Professional PHP Security Help?

Professional assistance may be useful if you cannot confirm your PHP version, your hosting provider cannot verify patch status, or your website runs on a server you do not manage directly.

You should also consider help if you find suspicious files, unexpected accounts or unexplained server activity. The assessment should distinguish between an unpatched installation, attempted exploitation and a confirmed compromise.

If you need help with server-level PHP patching, you can discuss your requirements through Alohomora Solution’s PHP vulnerability fixing service on Freelancer. The service listing describes PHP version audits, security patching, server verification, website testing and checks for suspicious files. The exact scope should be confirmed before work begins.

Does Updating PHP Guarantee That Your Website Is Safe?

No. Updating PHP addresses the vulnerabilities covered by the relevant security fix, but it does not guarantee complete website security.

Your website may have other vulnerable software, outdated plugins, weak credentials, incorrect permissions or an existing compromise. Separate vulnerabilities may also require additional patches.

After updating PHP, verify the active runtime, review relevant security advisories and investigate suspicious activity if the website may have been exposed.

Final Thoughts

Checking whether your website is affected by the latest PHP vulnerability starts with identifying the PHP version handling web requests and confirming that the appropriate security fixes are installed. Do not rely solely on the version displayed publicly, the absence of website errors or a routine WordPress update.

If your website was running an affected installation, verify the patch and consider whether the period of exposure warrants further investigation. Taking these steps helps you make informed security decisions without assuming either that your website is safe or that it has already been compromised.

Frequently Asked Questions