Is your PHP patched for PHP2Shell?

Last updated: 2026-10-23

Paste the PHP version your site runs, or the output of php -v. On WordPress, Site Health lists the PHP version. On Drupal, the status report does. The check runs in your browser and compares it with the fixed releases published by the PHP project. We do not patch PHP. Your host or system administrator installs the update. A WordPress site on that PHP is covered by the same result. WordPress to Next.js migration is a separate project from this check.

php -v · local check

PHP version or php -v output

$ check --local
Enter a PHP version
Paste a version or php -v output, such as 8.3.6 or PHP 8.2.34. This compares the text you typed. It does not test the vulnerability, it does not request your server, and it cannot prove the site is safe.

This check does not request your website and sends no exploit traffic. It applies to a WordPress host and a Drupal host. WordPress Site Health and a Drupal status report are two places the version is shown. Distro packages can be patched while still printing an old number.

Email me this result

This records the version you checked. It does not send mail, and it is not a request for us to patch PHP.

Patch guide for your host or sysadmin