How to check your PHP version, and what to compare it with

Only check systems you own or are responsible for. This page and our checker work from version numbers you type in. Nothing here tests, probes or scans a server. Independent site, not affiliated with the PHP Group or php.net.

Short answer

Run php -v on the server, then confirm the version your web PHP uses, because the command line and the website can run different builds. On Debian, Ubuntu, Red Hat-family and Alpine, the number you see may be older than the fix and still be patched, because distros back-port fixes: compare the package version with your vendor’s fixed package version, not the upstream number. Then paste both into the checker.

What you are comparing against

php2shell is the name Wiz Research gave to two critical PHP flaws (CVE-2026-109618, CVE-2026-109619). php.net says they “can allow unauthenticated remote code execution” and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (php.net advisory). Upstream fixed releases:

Anything below the fixed number for its branch is affected (GitHub advisory). php.net also says: “There are no complete mitigations, updating is the only safe choice.” The full table, with vendor package versions, is on fixed versions.

Step 1: Command line

php -v
which -a php
php -r 'echo PHP_VERSION, " ", php_sapi_name(), PHP_EOL;'

The first line of php -v is the version, and (cli) is the SAPI (the way PHP is run) (PHP manual). This is only the CLI. Your website is usually served by PHP-FPM, Apache or LiteSpeed, and a server can have several PHP versions installed at once, so php on your shell path may not be the one your site uses. Check the web side directly:

php-fpm8.3 -v        # Debian/Ubuntu: the binary name carries the version (try sudo if not found)
php-fpm -v           # RHEL-family and others
apache2ctl -M | grep -i php     # Apache with mod_php (httpd -M on RHEL-family)

Step 2: What the website really runs

If you can put a file in the site’s web folder, use a one-line test file instead of a full phpinfo() page. It prints only the version and the SAPI (fpm-fcgi, apache2handler, litespeed and so on, per the manual):

f="v-$(openssl rand -hex 8).php"
printf '<?php header("Content-Type: text/plain"); echo PHP_VERSION, " ", php_sapi_name(), PHP_EOL;\n' | sudo tee "/var/www/html/$f" >/dev/null
curl -s "https://your-site.example/$f"
sudo rm -f "/var/www/html/$f"

Use your real web root and domain. Without shell access, upload the same file by FTP or the file manager, open it once, and delete it straight away. If you prefer phpinfo();, look at PHP Version and Server API only, then delete the file: phpinfo() prints paths, settings and environment data that you do not want to leave on a public URL (manual).

Step 3: Your control panel

cPanel fixed EasyApache 4 builds (Version-Release from cPanel’s own spec files): ea-php85 8.5.12-1, ea-php84 8.4.27-1, ea-php83 8.3.36-1, ea-php82 8.2.35-1. For the end-of-life ea-php81, ea-php80 and ea-php74 the PHP version number does not change, because the fix is a back-port: look for 8.1.34-5, 8.0.30-12 and 7.4.33-19 (ea-php81 spec, ea-php74 spec, ea-php80 spec). On shared hosting you cannot update these yourself; see hosting status for your host.

Step 4: The package version on Linux

Distro packages keep their old upstream number and add a suffix when a fix is back-ported, so php -v can say 8.3.6 on a patched Ubuntu 24.04. Read the full package version instead.

Debian and Ubuntu:

dpkg -l | grep -E '^ii +php'
apt policy php8.3-cli                 # read Installed, not Candidate
apt changelog php8.3-cli | grep -m3 -E 'CVE-2026-10961[89]'

RHEL-family (RHEL, Alma, Rocky, Oracle, Amazon Linux):

rpm -qa | grep -i '^php'
rpm -q --changelog php-cli | grep -m3 -E 'CVE-2026-10961[89]'

Alpine:

apk list -I | grep -i php
apk version php84

A changelog line naming the CVE is good evidence that the fix is in. No match does not prove the package is vulnerable, so compare with the vendor figure:

More releases and the PPA or sury.org builds are in the Ubuntu and Debian guide and the fixed versions table. Remi’s RPM repository is volunteer-maintained and is not the distro’s own: it has 8.2.35, 8.3.36, 8.4.27 and 8.5.12 builds for Enterprise Linux 8, 9 and 10 dated 21 Oct 2026 (for example 8.4.27-1.el9.remi), though it does not name the CVEs (Remi repository). php.net had said on 21 Oct that it would not have updates that day (php.net); the per-version tables are on fixed versions.

Step 5: Docker

An image tag tells you what you pulled, not what is running. Check the container:

docker ps --format '{{.Names}}  {{.Image}}'
docker exec <container> php -v
docker exec <container> php-fpm -v     # only in -fpm images

Official php image tags combine a version and a variant such as -cli, -fpm, -apache or -alpine (Docker Hub). A moving tag like php:8.4-fpm only changes when you pull again. To update, rebuild or pull the image, then recreate the container (docker compose pull && docker compose up -d, or your orchestrator’s equivalent); restarting the old container keeps the old image. Compare with the upstream numbers in the first table. When we checked the registry on 21 Oct 2026 (17:11 UTC), the official php:8.5, php:8.4, php:8.3 and php:8.2 images had been rebuilt on 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but an older local copy of the same tag stays old until you pull, so confirm with php -v after you pull. Images with no fixed release (8.1 and older) need a patched build or an upgrade.

Step 6: Compare, then update

After you update, restart the PHP service so running workers load the new build, then check again:

sudo systemctl restart php8.3-fpm      # or php-fpm; or: sudo systemctl restart apache2 / httpd
ps -C php-fpm8.3 -o pid,lstart,cmd     # master process should show a start time after your update
php -v

Then repeat the Step 2 test file. Upgrading across branches (for example 8.1 to 8.3) can break plugins and extensions, so take a full backup or provider snapshot first.

Step 7: Paste it into the checker

Open the checker, choose your platform, and enter the version exactly as shown: the upstream number for php.net builds and Docker, or the full package string (for example 8.3.6-0ubuntu0.24.04.13) for distro packages. It compares what you type in the browser; it does not look at your server. For the wider picture, see what php2shell is, and if you sit behind a WAF, read Does a WAF protect you? before relying on it.

If you would rather not work it out yourself, there is a $49 personal patch plan: written steps for your exact setup by email within 24h. See /fix-service/.