Which PHP Version Is Your Site Running?
Four ways to find out, listed from most reliable to easiest. Once you know the exact version, the table below tells you whether you're exposed to CVE-2026-109618 and CVE-2026-109619.
Four Ways to Check
From the command line
- SSH onto the server (or open the host's terminal/console if it has one).
- Run: php -v
- You get output like PHP 8.3.36 (cli) — that triple number is the exact version.
- If the server runs multiple PHP versions, the CLI result may not be what the website uses; check the pool or site-specific setting too.
In WordPress / WooCommerce admin
- Log in to the WordPress admin.
- Go to Tools → Site Health.
- Open the Info tab, then Server — Current PHP version is listed there.
- This is the version WordPress reports; on a few hosting stacks it can differ from the CLI result, so treat it as the one that matters for your site.
In your hosting panel
- Open your hosting control panel (cPanel, Plesk, or the host's custom panel).
- Look for Select PHP Version, PHP Manager, or MultiPHP Manager.
- The listed version for your domain is what the web server uses.
- Changing versions there reboots PHP handlers; note the current value before changing anything.
The phpinfo file (use carefully)
- Create a file called phpinfo.php in your site's root with the single line: <?php phpinfo();
- Visit https://your-site/phpinfo.php and look for PHP Version at the top.
- Delete the file immediately afterwards — it leaks server configuration to anyone who finds it. Never leave it on a production server.
What Your Version Means
Fixed point releases shipped on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. At or above your row's number, you're patched; below it, you're exposed.
Common Questions
The panel shows one version and the site another — which wins?+
The PHP version the website actually executes with is the one that matters, and on shared stacks (LiteSpeed, Plesk MultiPHP) the site-level setting overrides the server default. Tools → Site Health in WordPress reports what your site is really using.
What do the three numbers mean?+
PHP 8.3.36 means major 8, minor 3, patch-level 36. The security fix for CVE-2026-109618 and CVE-2026-109619 landed in specific patch levels: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your patch-level is lower than your minor's fixed number, you're exposed.
Can someone check it for me?+
Yes — that's exactly what the £149 PHP check is: we confirm the version, the patch level, whether you're exposed, and the recommended fix, in a written report you can act on or file with your host.
Don't Want to Poke the Server Yourself?
The £149 PHP check confirms the version and patch level, whether you're exposed, and the recommended fix — in a written report you can act on or hand to your host.