PHP2Shell checker: is my PHP version affected?

Use the PHP2Shell checker below for every PHP runtime you operate: the host CLI, each PHP-FPM pool, Apache mod_php and each container image can all run different versions.

Tip: you can paste the whole first line of php -v, such as PHP 8.3.35 (cli) (built: …). The checker picks out the version number.

Is my PHP version affected by PHP2Shell?

• **Yes**, if you run PHP 8.2, 8.3, 8.4 or 8.5 below the fixed release in the table.
• **Probably yes**, if you run PHP 5.4 to 8.1: these branches are end of life and the PHP project shipped no official release. Some distributions (Ubuntu Pro, Debian LTS and others) backport the fix; see distro fixes.
• **Not affected per the advisory**, if you run the fixed release or newer in your branch, and you restarted every PHP worker after upgrading.

How to check if your server runs a vulnerable PHP version

These read-only commands only show versions on machines you control. Run them as the same user or inside the same container as the site, then paste the version into the PHP2Shell checker.

# 1. PHP version on the host (CLI)
php -v

# 2. PHP version inside each container
docker ps --format '{{.Names}}'
docker exec <container> php -v

# 3. Package version (shows distro backports)
dpkg -l | grep -E '^ii +php'          # Debian / Ubuntu
rpm -qa | grep -i '^php'              # RHEL / Alma / Rocky / Fedora / SUSE
apk info -v | grep -i '^php'          # Alpine

# 4. Version the web server actually runs (FPM / mod_php may differ from CLI)
php-fpm -v 2>/dev/null || ls /usr/sbin/php-fpm*

Which PHP versions are patched?

• Upstream fixed releases: **8.5.12**, **8.4.27**, **8.3.36** and **8.2.35** (source and Windows builds on php.net).
• Distribution packages: see the per-distro table in distro fixes.
• After upgrading, restart PHP-FPM, Apache (mod_php), php-cgi, LiteSpeed or FrankenPHP and rebuild containers. A running worker keeps the old code. Step by step: remediation.

PHP2Shell scanner vs version check

• A **version check** (this page) compares numbers you supply. It is safe, instant and works offline, but cannot see backports or tell whether the vulnerable code path is reachable.
• A **PHP2Shell scanner** sends requests to a server. Only run a scanner against systems you own or are authorised to test. This site does not scan, probe or fingerprint any third-party host.
• Many web servers hide the PHP version (expose_php = Off), so remote checks miss them. Checking from inside the server is more reliable.

Check bundled products

• Control panels, NAS devices, appliances and all-in-one stacks ship their own PHP and are patched on the vendor’s schedule: cPanel, Plesk, aaPanel, XAMPP, Bitnami, Coolify, CloudPanel, Synology, QNAP and more.
• Per-product status, check commands and fixes: affected products.
• Many hosts or containers? Let an AI coding agent take the inventory: check with an AI agent.

If the PHP2Shell check says you are affected

• Upgrade to the fixed release for your branch, or install your distribution’s security update: remediation.
• Restart every PHP worker and confirm the new version with php -v and a short-lived phpinfo() page you delete right after.
• If you cannot patch soon, consider taking the service offline, as several organisations did: outage tracker.