Am I affected by PHP2Shell?

Work through these three checks

1. Does this PHP installation serve web requests? Include panel-managed sites and bundled runtimes. PHP lists multiple web-serving configurations in its security announcement.
2. Which branch and package are running? Find the version through the panel or command line, then check the website runtime separately. PHP CLI documentation · WordPress Site Health.
3. Does the vendor confirm both fixes? Match the full revision and distribution release to the recorded package status. If evidence is missing, ask the host; do not treat an unknown result as fixed. Vendor backport guidance.

Copy the existing version check

This reports the command-line installation. It does not identify every web worker. PHP command-line options.

php -v

Existing command-test record: Ubuntu and Debian containers (ARM64); see platform guides for package revisions. Use the platform guide for installation and restart steps.

Compare the fixed release in your branch

• PHP 8.5: 8.5.12 or later in the same branch.
• PHP 8.4: 8.4.27 or later in the same branch.
• PHP 8.3: 8.3.36 or later in the same branch.
• PHP 8.2: 8.2.35 or later in the same branch.

PHP release announcement. A vendor backport can use a lower upstream number; use the complete package revision. Vendor guidance.

Understand the checker result

Below recorded fix / unsupported branch

A version below a recorded threshold needs an update. An end-of-life upstream branch needs a verified vendor backport or migration; its age alone does not establish vendor patch status.

Matches documented vendor fix

The complete revision matches a recorded vendor threshold for that distribution release. The comparison supports that this package build contains the fix; it does not authenticate the installed package or verify the website uses it.

Meets upstream fix threshold

The supplied stable version meets its branch threshold. The corresponding upstream release contains the fix; custom build provenance and the running website remain unverified.

Build fix not confirmed

The input is missing, incomplete, a prerelease or outside the verified vendor data. Obtain the exact build and advisory before drawing a conclusion.

Header hint — build not verified

A public header is only a version hint, even at a fixed version number. Neither the installed build nor the website workers are verified by that header.

These are this guide's evidence labels. They are not a remote security test or a compromise assessment. Read the data policy and runtime verification steps.

Apply the fix and verify the website

Choose your platform guide. Ask the administrator to confirm the package, complete the vendor restart procedure and verify every serving runtime. If you suspect earlier intrusion, use the compromise checklist as a separate task.