What to do about PHP2Shell

How to find your PHP version

You need the full version number, with all three parts, like 8.2.20. The last part tells you whether the fix is in. Pick whichever of these you can get to.

In WordPress

1. Log in to your WordPress dashboard as an administrator.
2. Go to Tools, then Site Health.
3. Open the Info tab and expand Server.
4. Read the line called PHP version. It looks like 8.2.20 (Supports 64bit values). The number at the start is what you need.

This is the version actually running your site, so it's the most reliable answer.

In Plesk

Go to Websites & Domains, pick your domain and open PHP (sometimes shown as PHP Settings). The PHP version list shows the full number for each version installed.

In cPanel

cPanel's MultiPHP Manager and Select PHP Version screens usually show only the first two parts, such as PHP 8.2. That's not enough to know whether you're patched. Use WordPress Site Health if you can. If not, use the phpinfo method below, or ask your host.

With a temporary phpinfo file

This works on any hosting where you can upload files. The file shows details about your server to anyone who finds it, so delete it straight away.

1. Create a file with a hard-to-guess name, like info-7f3k9.php, containing just <?php phpinfo();
2. Upload it to your site's main folder and open it in your browser, for example https://yoursite.ie/info-7f3k9.php.
3. The version is in the large heading at the top: PHP Version 8.2.20.
4. Delete the file immediately.

While it's open, also note the Build Date near the top. Some hosts patched older versions without changing the version number. A build date of 21 October 2026 or later is a good sign that yours includes the fix.

On the command line

If you have SSH access, php -v shows the command-line PHP. Websites are often served by a different PHP (PHP-FPM), which can be a different version. Check the one your site uses, for example php-fpm8.2 -v on Ubuntu or Debian. The server guide covers this in more detail.

Ask your host

If none of these work, your host can tell you. Our hosting guide has an email you can send that asks for the version and whether it's patched in one go.