Frequently asked questions
Short answers. Follow the links for the checker and the per-distribution tables.
Does this site scan my website?
No. It never contacts your site or any server. You enter a version number and the comparison runs in your browser against tables embedded in the page.
My version is lower than the fixed one but my distro says it is patched. Who is right?
Compare rather than assume. Vendors back-port fixes into older version numbers, for example 8.3.6-0ubuntu0.24.04.x can contain a fix that upstream shipped in 8.3.36, but only if your vendor has published that fix for your release. Use the Linux package tab, which compares against the vendor's own fixed package version. Some releases have no vendor fix yet or are end of life.
I am on shared hosting and cannot run commands. What can I do?
Your host has to install the fixed PHP build. Choosing another branch in the control panel does not patch anything by itself. Check which PHP version your site uses there, then see the hosting status page for what your provider has said. If there is no statement, ask support whether the fixed build is installed and PHP restarted. Some hosts patch in place without changing the version number.
Are PHP 7.4, 8.0 and 8.1 covered by the fix?
A version number alone cannot show that. These branches get no regular releases from the PHP project. For 7.4, 8.0 and 8.1 the PHP security team published minimal source-only backports (git branches, no release or version number) for people who build from source; otherwise the fix has to come from a vendor back-port. Check your distribution or host advisory, or move to a supported branch.
I run Docker. What do I do?
Pull a fixed tag, rebuild your image with --pull --no-cache and redeploy the container. A running container keeps its old PHP until you do.
Do I need to restart anything after updating?
Yes. Restart PHP-FPM or your web server so running processes load the new PHP, then run the check again.