PHP & WordPress
How to Check Your PHP Version (cPanel, WordPress, CLI) and Whether It Is Safe
Knowing your exact PHP version matters more than usual this year. The PHP2Shell vulnerabilities patched on 21 October 2026 affect every PHP version from 5.4 up to the fixed releases, and PHP 8.2 reaches end of life on 31 December 2026. This guide shows how to find your PHP version in every common setup, then how to tell whether that version is safe.
Related service: PHP upgrades and system modernization
By Abuzar · October 30, 2026 · 5 min read · Updated October 30, 2026
Is my PHP version safe? (PHP.net, October 2026)
| PHP branch | Security support until | PHP2Shell fixed in | Safe? |
|---|---|---|---|
| 8.5 | 31 Dec 2029 | 8.5.12 | Yes, on 8.5.12 or later |
| 8.4 | 31 Dec 2028 | 8.4.27 | Yes, on 8.4.27 or later |
| 8.3 | 31 Dec 2027 | 8.3.36 | Yes, on 8.3.36 or later |
| 8.2 | 31 Dec 2026 | 8.2.35 | For now. Plan an upgrade before 2027 |
| 8.1 and older | Ended | No official release | No. Upgrade or use a vendor backport |
What is the quickest way to check your PHP version?
The quickest way to check your PHP version depends on your access. With SSH, run php -v. On WordPress, open Tools, then Site Health, then the Info tab and expand Server. On shared hosting, open the PHP version selector in cPanel or Plesk. Each method takes under a minute.
Write down the full version, such as 8.3.36, not just 8.3. The last number tells you whether the latest security patch is installed.
Which PHP versions are safe in 2026?
Safe PHP versions are those still inside official security support and patched for PHP2Shell: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later. PHP 8.1 and older are end of life and get no official fixes. PHP 8.2 is safe until 31 December 2026, after which it stops receiving security updates.
For a new project or an upgrade, choose PHP 8.4 or 8.5. They have the longest support windows, and most WordPress plugins and current Laravel and Symfony releases support them. Our PHP end-of-life guide explains the support dates in detail.
How do you check the PHP version in cPanel or Plesk?
In cPanel, log in and open Select PHP Version or MultiPHP Manager under Software. The current version is shown at the top, or per domain in MultiPHP Manager. In Plesk, open Websites & Domains, then PHP Settings for the domain. The version and handler (for example FPM) are listed there.
Hosting panels often show only the branch, such as 8.3. To see the exact patch release, use WordPress Site Health or a temporary phpinfo() file, both covered below.
How do you check the PHP version in WordPress?
In WordPress, go to Tools, then Site Health, then the Info tab, and expand the Server section. The PHP version line shows the exact version the website runs. Site Health also warns you on the Status tab when your PHP version is outdated.
This is the most reliable check for WordPress, because it shows the PHP the web server actually uses, not the command-line PHP.
How do you check the PHP version from the command line?
From the command line, run php -v. The first line shows the version, for example PHP 8.4.27 (cli). Run php-fpm -v, or the versioned command such as php-fpm8.4 -v, to see the version the web server uses through PHP-FPM.
Servers often have several PHP versions installed. The command-line default can be 8.4 while a site still runs 8.1 through its FPM pool, so always check the web version too.
How do you check the PHP version with phpinfo()?
Create a file named with a random name, such as check-8f3a.php, containing <?php phpinfo(); and upload it to your site’s web root. Open it in a browser and read the version at the top of the page. Then delete the file immediately, because it shows server paths and settings attackers can use.
How do you check the PHP version in Laravel, Composer or Docker?
In Laravel, run php artisan about to see the PHP and Laravel versions together. Check composer.json for the require.php constraint, which tells you which PHP versions the project is meant to support. In Docker, run docker exec <container> php -v, or read the FROM line of the Dockerfile, such as php:8.3-fpm.
A Dockerfile that pins only the branch, such as 8.3-fpm, picks up patch releases when you rebuild the image. A running container does not update itself, so rebuild and redeploy after a security release.
What should you do if your PHP version is not safe?
If your PHP version is not safe, first update to the latest patch release on your branch, such as 8.3.36. If your branch is end of life, plan an upgrade to PHP 8.4 or 8.5, test the site on a staging copy, then switch. If anything looks wrong after PHP2Shell, check the site for signs of compromise.
Old applications written for PHP 5 or 7 usually need code changes before they run on PHP 8. Our guide to upgrading PHP 5 and 7 applications covers the common breaking changes and how long an upgrade takes.
- 1. Note the exact PHP version and where you found it.
- 2. Compare it with the table above.
- 3. Update to the latest patch on your branch today.
- 4. If the branch is end of life, schedule an upgrade to PHP 8.4 or 8.5.
- 5. Test forms, logins and checkout on staging before switching the live site.
Frequently asked questions
What is the current safe PHP version?
As of October 2026, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later are patched for PHP2Shell and inside security support. PHP 8.4 or 8.5 is the best choice for an upgrade.
Is PHP 8.1 still safe to use?
No. PHP 8.1 reached end of life on 31 December 2025 and gets no official security fixes, including for PHP2Shell. Upgrade to PHP 8.4 or 8.5, or use a vendor backport as a short-term measure.
Why does php -v show a different version from my website?
Servers often have several PHP versions installed. php -v shows the command-line default, while the website runs whichever version its PHP-FPM pool or hosting setting uses.
How do I check my PHP version without SSH access?
Use WordPress Site Health, your hosting panel’s PHP selector, or a temporary phpinfo() file that you delete straight after reading it.
Will upgrading PHP break my website?
It can if the code or plugins use features removed in newer PHP versions. Test the upgrade on a staging copy first and check forms, logins and checkout before switching the live site.
How often should I check my PHP version?
Check it at least once a quarter and after every PHP security release. A maintenance plan should do this for you.
Sources
Related articles
- Laravel Upgrade Guide 2026: Version Support, PHP Requirements and a Safe Upgrade Plan
Upgrade Laravel safely: which versions still get security fixes, PHP requirements, a step-by-step upgrade path, Shift and Rector tooling, risks and cost.
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Is Your Website Affected and What to Do Now
PHP2Shell lets attackers run code on PHP servers without logging in. Check if your site is affected, which PHP versions are patched, and what to do today.
- PHP End of Life in 2026: Is Your PHP Version Still Safe, and What Should You Do?
PHP 8.1 is already end of life and PHP 8.2 follows on 31 December 2026. See every PHP version’s support dates and your options: upgrade, patch or migrate.