How to Check Which PHP Version Your Website Really Runs (Black October)

By Umair Ali Sadaqat · Updated October 22, 2026 · Editorial policy

The PHP version on your command line is often not the one serving your website. Six reliable ways to find the real one, and how to read distribution version numbers after the PHP2Shell fixes.

After the Black October PHP fixes, the first job is knowing your PHP version. That sounds trivial, and it is the step people most often get wrong: a server can have three or four PHP builds installed, and the one you see in a terminal may not be the one answering visitors.

The versions that contain the fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer in those lines.

Why the terminal can mislead you

Typing php -v shows the command-line build. Your website is usually served by a separate program: PHP-FPM, Apache's mod_php, or LiteSpeed's own PHP handler. On cPanel and Plesk servers each account, or even each folder, can pick a different version. Docker containers carry their own copy inside the image. So treat php -v as a clue, not an answer.

Method 1: ask the web server (most reliable)

Create a file called something hard to guess, for example v-7f3k.php, in your site's public folder:

``php <?php echo PHP_VERSION; ``

Open it in a browser. The number you see is the version that serves that folder. Delete the file straight away. Avoid a full phpinfo() page on a live site; it reveals paths and settings an attacker would love to read.

Method 2: the WordPress dashboard

Go to Tools → Site Health → Info, open the Server section, and read "PHP version". This comes from the running site, so it is trustworthy. Details for WordPress owners are in the WordPress guide.

Method 3: other CMS admin screens

Joomla: System → System Information.
Drupal: Reports → Status report.
PrestaShop: Advanced Parameters → Information.

Each one reports the PHP that runs the admin, which on almost every setup is the same one that serves the public site.

Method 4: the hosting control panel

In cPanel look for Select PHP Version or MultiPHP Manager; in Plesk open the domain's PHP Settings. These show which branch is selected. They often do not show the patch number, so combine this with Method 1. The shared hosting guide explains what to ask your host when the panel is vague.

Method 5: the server shell

If you have root access:

```bash

Which FPM services exist?

systemctl list-units --type=service | grep -i php

Version of a specific FPM binary

php-fpm8.3 -v # Debian/Ubuntu naming /usr/sbin/php-fpm -v # Red Hat style

Installed package version (shows the distro patch suffix)

dpkg -l | grep php8 # Debian/Ubuntu rpm -qa | grep php # Red Hat, Alma, Rocky ```

Method 6: containers

For Docker, run the version check inside the running container, not on the host:

``bash docker exec <container> php -v ``

The Docker guide covers why pulling a new image is not enough on its own.

Reading distribution version numbers

Distributions such as Ubuntu, Debian and Red Hat backport security fixes into the version they shipped. That means a package can be labelled 8.1 or 8.3.6 and still contain the PHP2Shell fix, through a suffix like -1ubuntu1.x or -el9_x. The PHP advisory confirms that Linux distributions and long-term support vendors received the patches in advance.

The rule: if you installed PHP from your distribution, check the distribution's security notice for your package, then run your normal system update. If you built PHP yourself or used php.net downloads, compare against the four fixed numbers above.

What to do with the answer

Already on a fixed version: restart PHP once more if you have not since updating, then check for signs of an earlier break-in.
On 8.2 to 8.5 but older: update now.
On 8.1 or below: read the old-versions guide.
Cannot change it yourself: ask your host for the exact version serving your site and the date they patched.

Move your site to WeInc

If checking versions is not how you want to spend your week, WeInc sites run without a PHP server to maintain. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

Alternatives mentioned in this article

WordPress alternatives

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.