PHP2SHELL SECURITY SUPPORT
Start with your website address. Check your PHP risk, then get expert help to patch your existing website with minimal disruption.
Find out where to focus your next step.
Already know you need support?
Get a quick fixKeep your website. Resolve the risk.Call 0203 599 8122
Your website. In experienced hands.
Cyber Essentials Plus
ISO 27001 certifiedPHP BASICS
PHP is the server-side language behind a large share of business websites, including WordPress, WooCommerce, Drupal, Joomla, Magento and custom Laravel applications. Each time someone opens a page, PHP runs on your server to build it: it loads content from the database, processes contact and checkout forms, sends emails and talks to payment, booking or CRM systems.
The PHP version matters because the PHP project only maintains a branch for a limited time. Each branch gets two years of active support with bug and security fixes, then two years of security fixes only. After that it reaches end of life and receives no further fixes, even for serious vulnerabilities.
Staying current also keeps a website dependable. Plugins, themes and frameworks steadily drop support for older branches, and newer releases bring performance and reliability improvements. Most updates do not mean a rebuild: moving to a newer patch release within the same branch is usually routine, while moving between branches (for example 8.1 to 8.3) needs a compatibility check of your CMS, plugins and custom code first.
If your website needs that compatibility work, our website development and web application teams can plan it with minimal disruption.
SECURITY UPDATE
On 21 October 2026 the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have become known as PHP2Shell. Both are rated 9.2 (critical) and can allow an attacker to run code on a web server without logging in.
In plain terms, the flaws are in PHP itself rather than in a plugin or theme. One concerns how PHP handles running out of memory part-way through a request; the other concerns internal data from one request being reused by a later request after it should have been cleared. The PHP project says every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php.
On 23 October 2026 the PHP project also published an informational advisory suggesting session.upload_progress.enabled=0 until the next regular release, to close a separate and unlikely session issue (CVE-2026-115560). Meeting the PHP2Shell version release does not cover that issue or any other security problem on your website.
For a walkthrough of checking patches on your own server, read our guide Am I vulnerable to PHP2Shell?
VERSION NUMBERS
Any public check, from response headers to online lookup tools, can only report what a website chooses to reveal. Treat a publicly visible version as a useful clue, and confirm it before deciding what to do.
Many servers switch off expose_php or strip the X-Powered-By header. That is good practice, and it means no version is shown publicly.
Services such as Cloudflare or a hosting firewall sit in front of your server and can remove, cache or replace the headers a public check relies on.
Ubuntu, Debian, Red Hat, AlmaLinux and many hosts patch PHP without changing the upstream number, so an older-looking version can already include a fix.
A React, Next.js or Vue frontend can still rely on PHP for its CMS, API or checkout. Seeing a JavaScript framework does not rule PHP out.
If you or your developer use a terminal, remember that php -v shows the command-line PHP. Servers often have several PHP versions installed, and the one serving your website through PHP-FPM or Apache can differ from the command-line one.
Please don't publish a phpinfo page to check, and never share server passwords or control panel logins by email or chat. Both expose information attackers look for.
GSS Tech Solutions leads the industry in terms of website development services. Our customers can attain creative levels of achievement in their particular sectors by using our technological solutions. We help customers ensure their web-based solutions include the right combination of strategy, design, technology, and experience.
Questions
Answer
The most reliable way is to check the PHP settings in your hosting control panel (for example cPanel or Plesk), look at Tools, Site Health, Info in WordPress, or ask your hosting provider which PHP version and package serve your website. You can also enter the address in the checker above to see what the website discloses publicly, such as an X-Powered-By response header.
No. A public check can only read what a website reveals, and many servers deliberately hide their PHP version. Proxies and CDNs can also remove or replace the headers that disclose it. When no version is disclosed, the only reliable answer comes from your hosting dashboard or provider.
Hiding the version is a common hardening step. Hosting providers often switch off the expose_php setting or strip the X-Powered-By header, and CDNs or firewalls in front of a website may remove it too. A hidden version is normal and does not tell you whether PHP is up to date.
No. An unavailable version simply means it was not disclosed publicly. It says nothing either way about whether your installation has the latest security fixes, which is why the version should be confirmed through your hosting dashboard or provider.
PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, published by the PHP project on 21 October 2026. They can allow unauthenticated remote code execution on servers that handle web requests. The upstream fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. See PHP2Shell and current PHP security updates above for details.
No. Running a supported, up-to-date PHP release removes known PHP flaws, but website security also depends on your CMS, plugins, themes, custom code, server configuration, credentials and hosting environment. A version number is one useful signal, not a security assessment.
Yes. Linux distributions such as Ubuntu, Debian, Red Hat and AlmaLinux often backport security fixes into their own PHP packages while keeping the original upstream version number. That is why a reported version that looks old should be confirmed against your provider's or vendor's advisory before you assume an update is needed.
No. WordPress is an application that runs on PHP, and the two are updated separately. WordPress updates change the WordPress code, while PHP is part of the server and is changed through your hosting control panel or by your hosting provider. Check plugin and theme compatibility before switching PHP branches.
Yes. Our team can help confirm which PHP runtime serves your website, check compatibility with your CMS, plugins and custom code, and plan an update with your hosting provider. Contact our team to discuss your website.
