Is my WordPress site patched? Checking your PHP version

What happened

On October 21, 2026 the PHP project released fixes for two critical vulnerabilities, widely called PHP2Shell and rated 9.2 out of 10 for severity. They are in PHP itself, not in WordPress or a plugin, so every site that runs on PHP should be on a fixed build. WordPress sites included.

Updating WordPress, your theme or your plugins does not change PHP. Only whoever runs your server can install the fix, which for most sites means your hosting company.

Which versions have the fix

The fixed releases are:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

PHP 8.1 and anything older gets no fix at all. A site on one of those needs moving to a supported version.

Find your PHP version

1. 1

   Open Site Health

   In your WordPress admin, go to Tools → Site Health and click the Info tab.

2. 2

   Open the Server section

   Click Server to open it. The PHP version is listed there.

Why the number alone can mislead

Many hosts install the fix into the version you already run without changing the version number. GoDaddy customers, for example, saw 8.4.26 with a build dated October 21, 2026: lower than 8.4.27 on paper, but with the fix inside. So a lower number is not proof that your site is unpatched.

The proof is the PHP build date. If it is October 21, 2026 or later, the fix is in.

The easy way: ask your host

Your host knows the answer. Send their support team one question:

Your hosting control panel's PHP settings page sometimes shows the build date too, so it is worth a look while you wait for a reply.

What owners found at the big hosts

These come from site owners working through this in the days after the fix, as of October 24, 2026. Hosting panels change, so treat them as pointers rather than exact steps.

• GoDaddy (Web Hosting with cPanel): the PHP version setting now lives in your GoDaddy account, under your Web Hosting product's settings, rather than inside cPanel. The versions on offer may still read 8.4.26 or 8.5.10, but patched builds are dated October 21, 2026, so check the build date before assuming the worst.
• Bluehost: PHP can be set in two places, the site's Manage Site → Advanced → PHP Version and cPanel's MultiPHP Manager, and the two can end up different. Check both show the version you expect.
• Any host with cPanel: MultiPHP Manager shows which PHP version each of your domains uses, which helps when you have more than one site on the account.
• A server you run yourself: your Linux distribution's security updates may already have installed the fix (one owner on Ubuntu 22.04 found exactly that), and the version number follows the distribution's own numbering. The build date settles it.
• Typing php -v on the server: the command line can run a different PHP from the one serving your website. Check from the site itself (Site Health or phpinfo), not the terminal.

If you took your site offline

Some owners switched their sites off or into maintenance mode while they waited for their host. Before you bring yours back, check the build date: if it is October 21, 2026 or later, the fix is already in and the site can come back now.

If you would rather check yourself

This is the technical route, and asking your host is just as good. PHP can print a page of details about itself, called phpinfo, which includes the build date.

1. 1

   Create the file

   Make a file in your site's main folder, for example check.php, containing only <?php phpinfo();.

2. 2

   Read the build date

   Open that file's address in your browser and look for Build Date near the top.

3. 3

   Delete the file straight away

   The page shows anyone who finds it details about your server. Delete the file as soon as you have read the date.

If your host will not offer a fixed version

If your site is on PHP 8.1 or older and your host offers nothing newer, or the host will not install the fix, that is a reason to move to another host.

Before you change PHP

Moving to a newer PHP version can break an old plugin or theme. Take a backup of the site first. If something does break, switching back is usually one setting in your hosting panel.

Where Sarcio fits

Sarcio does not update PHP and does not protect a site from this flaw: that is your host's job. What the Sarcio plugin does is help you build and change your site. Ask for a change in plain words, preview it on your own site, then approve it. Its safe plugin updates check the site after each update and put it back if something broke. See Sarcio for WordPress.