Is My Website Affected by PHP2Shell? 4 Ways to Check Your PHP Version
Your exposure to PHP2Shell comes down to one number: your PHP version. If it is below the patched release for your branch, you are affected. Here are four ways to find out, from fastest to most definitive.
1. Run our free scanner (fastest)
Paste your URL into the PHP2Shell Scanner. It performs a passive, read-only check and reads the public version banner, then tells you Affected, Patched, or Unknown — plus a full security report.
expose_php = Off). If the scanner can't read it externally, use one of the methods below.2. php -v over SSH (most definitive)
If you have shell access, nothing beats:
php -v # CLI version
php-fpm -v # the version serving your site (may differ!)Check the handler that actually serves web traffic, not just the CLI.
3. Hosting control panel
- cPanel: MultiPHP Manager, or Select PHP Version.
- Plesk: Websites & Domains → PHP Settings.
- Managed hosts: look for a “PHP version” setting in your dashboard.
4. WordPress Site Health
In WordPress, go to Tools → Site Health → Info → Server. The exact PHP version is listed there — no SSH needed.
Then what?
Compare your version to the patched list (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12). Below it on a supported branch? Do a point update. On 8.1 or older? You need a branch upgrade. Full steps: How to fix PHP2Shell.