PHP2Shell.fyi Check a site

How to check your PHP version

To know whether PHP2Shell is fixed, you need the version of the PHP that serves your website. That is not always the one php -v prints in a terminal.

Last reviewed . Rules of .

Where to look first

Web PHP and command-line PHP can differ

One server can have more than one PHP. The website may run on PHP-FPM, Apache mod_php or php-cgi, while the php command in a terminal is the command-line (CLI) build. They can be different builds or even different branches: a server can show 8.4 in the terminal and serve the website with 8.2.

Check the PHP that answers web requests. Use the app’s admin screen, your hosting panel, a short phpinfo() test, or the version of the PHP-FPM binary your site uses.

Use phpinfo() safely

phpinfo() shows the version of the PHP that runs the web page. It also shows a lot of private data: paths, settings, environment variables, cookies and request headers. Never leave it online.

  1. Create a file with a random name in your web root, for example info-7f3k9q.php, with this content: 
    <?php phpinfo();
  2. Open it in your browser once. Read the version at the top and the Server API line. That line tells you if the site uses FPM, mod_php or CGI.
  3. Delete the file straight away, then check that the URL returns 404.

On the command line

php -v

php -v

This prints the version of the CLI binary in your PATH. Use it to check the PHP for scripts and cron jobs. For the website, also check the FPM binary or use phpinfo.

php-fpm -v

PHP-FPM is a separate binary with its own -v option. Its name depends on the system:

# Debian and Ubuntu: one binary per branch
php-fpm8.3 -v
# RHEL, AlmaLinux, Rocky
php-fpm -v
# Not sure? List the binaries
ls /usr/sbin/php-fpm*

If you run several FPM versions, find the one your site's pool or virtual host points to.

Check the package version

Some Linux distributions add the fix to their own package and keep the old upstream number. Ubuntu 24.04 reports PHP 8.3.6, but its fixed package is 8.3.6-0ubuntu0.24.04.13. Only the package version tells you whether you have the fix.

# Debian and Ubuntu
dpkg -l | grep -E '^ii +(php[0-9.]*-(fpm|cgi|common)|libapache2-mod-php)'
# RHEL, AlmaLinux, Rocky (php8.4-common for PHP 8.4 on version 10)
rpm -q php-common
# Alpine
apk info -v | grep '^php'

Compare the result with the fixed package for your release on Fixed PHP packages on Linux.

A base number like 8.3.6, 8.1.2 or 7.4.33 may be a distribution build.

They are lower than the fixed releases, but the package can still contain the fix. Read the full package version before you decide.

Docker and containers

docker exec <container> php -v

This shows the PHP inside a running container. To change it, pull the updated base image, rebuild your image and recreate the container. A restart alone keeps the old PHP (our advice).

Hosting panels

On cPanel, the MultiPHP Manager lists each domain and its PHP version. "Inherited" means the domain uses the server's default PHP. Your host can turn this screen off. Other panels have similar screens.

A panel shows the branch you selected, not always whether the host installed the patched build. If you are not sure, ask your host to confirm that your PHP has the fix for CVE-2026-109618 and CVE-2026-109619.

What the X-Powered-By header shows

PHP’s expose_php setting is on by default, and PHP then adds a response header such as X-Powered-By: PHP/8.3.6. The php2shell.fyi checker reads this header.

Product-specific screens

WordPress, Drupal, Joomla and other apps show the PHP version in different places. See Platforms for each product.

Check your site

Run the php2shell.fyi checker on your own site to see what it reveals in public. Confirm its result on the server with the steps above, or with your host.

Sources