PHP version in WordPress: how to check and update it

WordPress runs on PHP, and the PHP version decides whether your site still gets security fixes. In October 2026, two critical vulnerabilities were found in PHP that could only be fixed by updating PHP. Updating WordPress did not help. This guide shows you how to check your PHP version in a couple of minutes, which version is safe, and how to update without breaking your site.

PHP2Shell: why your PHP version matters now

On 21 October 2026, PHP released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), known as PHP2Shell. Both are rated 9.2/10 for severity (CVSS 4.0). In the worst case, an attacker can run their own commands on the server without logging in. On Apache installations with mod_php, the attack can start before any WordPress code runs at all.

The vulnerabilities affect all versions of each PHP branch before the fixed release: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer get updates from the PHP project. On 23 October, PHP announced a third vulnerability (CVE-2026-115560), which can only be exploited with a rare combination of settings and application code. It will be fixed in the next regular release.

According to Finland’s National Cyber Security Centre (NCSC-FI), there was no information about active exploitation as of 21 October, but working proof-of-concept code already existed, so the situation can change quickly.

PHP gets security fixes several times a year, but only supported branches receive them. Each branch is fixed for about four years, and holes found after that stay open. That is why you should check your PHP version regularly, not only when a vulnerability is in the news.

How to check your PHP version

In the WordPress admin

Log in to WordPress as an administrator.
In the left-hand menu, choose Tools → Site Health.
Open the Info tab and then the Server section.
The PHP version row shows the exact version number, for example 8.3.36.

Look at the whole number. The branch (8.3) tells you whether the version is still supported, and the last number (36) whether the latest fix is installed. If the version is outdated, WordPress also shows a PHP Update Required warning on the dashboard. Don’t wait for the warning, though. Check the number yourself.

In your hosting control panel

With most hosting providers, you can see and change the PHP version in the control panel. In cPanel, the option is usually called MultiPHP Manager or Select PHP Version. In Plesk, you find it in the PHP settings of each domain. If you can’t find it, ask your hosting provider which PHP version your site uses and whether the October 2026 fix is installed.

On the server (for administrators)

On your own server, the command php -v shows the version of the command-line PHP. Your site may not run on the same PHP, because the web server can use a different version through PHP-FPM or the Apache module. The most reliable answer is in the WordPress Site Health view.

Linux distributions such as Debian, Ubuntu and Red Hat often backport fixes into their own packages without changing the version number. So the number can look old even though the fix is installed. In that case, check whether the package changelog mentions the CVE IDs.

Which PHP version is safe?

A safe version meets two conditions: the branch still gets security fixes, and the server has the latest patch release of that branch. In October 2026, the situation is as follows:

PHP branch	Security support ends	PHP2Shell fixed in
8.5	31 December 2029	8.5.12
8.4	31 December 2028	8.4.27
8.3	31 December 2027	8.3.36
8.2	31 December 2026	8.2.35
8.1 and older	ended (8.1: 31 December 2025, 7.4: 28 November 2022)	no official release

WordPress recommends PHP 8.3 or newer. It still runs on PHP 7.4, but wordpress.org warns that an outdated version can expose your site to security problems. Support for PHP 8.2 ends at the end of 2026, so if your site uses it, plan the move to 8.3 or 8.4 now.

For versions 7.4, 8.0 and 8.1, the PHP security team released the PHP2Shell fix only as source code, for those who compile PHP themselves. Some Linux distributions and hosting providers build their own patched packages for old versions. The permanent solution is still to move to a supported version.

How to update PHP

With a hosting provider

Fixes within the same branch (for example 8.3.35 → 8.3.36) are usually installed by the hosting provider. Changing the branch (for example 8.1 → 8.3) is usually something you do yourself in the control panel. Here is how:

Take a backup of the files and the database. Many hosts let you do this in the control panel.
Update WordPress, themes and plugins. An outdated plugin or theme is a common reason why a site breaks during a PHP update.
Test on a copy first if your host offers a staging environment.
Change the PHP version in the control panel.
Go through the site: the home page, forms, the shop checkout and the admin. Check in Site Health that the new version is in use.

If something breaks, switch back to the previous version for a moment, fix or replace the problem plugin, and try again. Don’t stay on the old version.

On your own server

Install your distribution’s updated PHP packages (for example apt upgrade or dnf upgrade) or compile the fixed version.
Restart PHP-FPM, Apache and any other processes that run PHP, such as background jobs. The fix only takes effect after that.
If the site runs in a container, build a new image on the fixed PHP and deploy it.
Finally, check the version in Site Health.

If you can’t update right away

According to PHP, the only complete fix is to update. If the update is delayed, the server administrator can reduce the risk with settings that PHP recommends in its advisories. On shared hosting, the provider usually decides on these settings.

session.upload_progress.enabled=0 blocks the confirmed attack methods for CVE-2026-109619 and CVE-2026-115560. PHP recommends keeping the feature off even after the update if you don’t need it.
In PHP 8.5, fatal_error_backtraces=0 removes a second confirmed attack method.

Neither setting protects against CVE-2026-109618. The settings can buy you time, but they don’t replace the update.

Frequently asked questions

Does WordPress update PHP automatically?
No. WordPress updates itself, but PHP is server software that the hosting provider or the server administrator updates. That is why updating WordPress does not fix the PHP2Shell vulnerabilities.

Which PHP version should I choose for WordPress?
WordPress recommends PHP 8.3 or newer. In October 2026, 8.3 and 8.4 are good choices, as long as the latest fix is installed and your plugins support the version.

Will a PHP update break my site?
A patch release within the same branch, such as 8.3.35 → 8.3.36, rarely breaks anything. Changing the branch can break an old plugin or theme, so take a backup and test first.

Is PHP 7.4 still safe?
No. Its security support ended on 28 November 2022. WordPress still runs on 7.4, but wordpress.org warns that an outdated version can expose your site to security problems.

How do I know if my host has installed the PHP2Shell fix?
Look up the full PHP version number in Site Health and compare it with the table above. If the number is lower, ask your hosting provider whether the fix is included in their package.

If a PHP update breaks a plugin or you need someone to maintain your site, contact us. We help with updating WordPress and PHP applications.

PHP version in WordPress: how to check and update it

PHP2Shell: why your PHP version matters now