My site is on shared or managed hosting
On most hosting you can't update PHP yourself: your host does it for every site on the server. Your job is to find out whether they have, and to push if they haven't.
1. Check your PHP version
Find your PHP version, then check it. If it's a fixed version, you're covered. It's still worth asking your host to confirm, because larger sites can run on several servers.
2. Ask your host
Send this through your host's support system or by email. It asks the specific questions that get a useful answer.
3. Judge the answer
A good answer is specific: the version or package, and when it was done.
- “All our servers now run PHP 8.3.36. PHP was restarted on 22 October.”
- “Your site runs PHP 8.1 with our vendor's backported fix for both CVEs, installed on 22 October.”
- “We keep WordPress and your plugins up to date.” This doesn't touch PHP.
- “We have a firewall.” That helps, but it isn't the fix.
- “We're looking into it,” with no date.
Check our host status page too, in case your host has posted a public update.
4. If your host hasn't patched yet
- Put the site behind Cloudflare. Cloudflare's free plan includes emergency rules that block known PHP2Shell attacks. You switch your domain's nameservers to Cloudflare and keep your hosting as it is. It's a stop-gap, not a fix.
- Switch to a newer PHP if your panel allows it. Many hosts let you pick PHP 8.2, 8.3 or 8.4 per site. Switching only helps if the host has updated that version, so check the full number afterwards, and test your site.
- Set a deadline. If your host can't give you a date for a critical flaw that attackers are already probing, consider moving to a host that can.
- Consider taking the site offline. If PHP can't be patched or mitigated soon, government agencies advise taking it offline until it is. See should I take my site offline?
If you're on PHP 7 or older
There's no official fix for PHP 8.1 and older, and nothing at all for PHP 7.3 and older. Unless your host has applied a vendor patch, the only real fix is moving to PHP 8.2 or newer. Older sites can break on newer PHP, so test a copy first. Our WordPress guide covers how.