PHP vulnerability questions answered
Which versions include the PHP2Shell fix?
The upstream fix starts at 8.5.12, 8.4.27, 8.3.36, 8.2.35. A distribution can include a backport at a lower upstream number; compare the full package revision.
Why does my PHP version still look old after updating?
Distribution vendors often backport a PHP vulnerability fix without changing the upstream version. Match the installed package revision to your vendor advisory and confirm the web runtime.
Does updating command-line PHP also update my website?
It depends on your installed runtimes. The command line, PHP-FPM and a hosting panel can use different binaries. Verify the runtime serving each website after the PHP security update.
Do I need to restart PHP workers?
Yes. Follow the vendor restart procedure for all serving workers, including PHP-FPM, Apache and long-running application workers. A package update alone does not prove every process is running the new runtime.
What should I do with an end-of-life branch?
Confirm whether your vendor has a backport for this PHP vulnerability and plan a migration to a supported branch. This guide uses 8.4 as its default migration target; test application compatibility first.
Can this checker scan my website?
No. It only parses text you paste into this browser tab. It does not accept a website URL, contact your server or establish whether a server has been compromised.
Is this guide affiliated with the PHP project?
No. This guide is independent. PHP advisories and vendor documentation are linked in Sources.
Can temporary settings replace the update?
No. Read the temporary measures and availability tradeoffs in the PHP advisory. A verified runtime update is the complete fix.
Does updating WordPress fix the server runtime?
A WordPress application update does not replace your server PHP runtime. Ask your host to confirm the PHP vulnerability package update, and check Site Health after the change.
Can I use a release candidate?
Do not use a prerelease as evidence that a production runtime includes the PHP2Shell fix. Choose a stable supported release and verify its complete package or image version.
What does an unverified platform status mean?
We could not confirm the exact vendor package or environment. Read the linked vendor source. An upstream fix does not establish that every vendor has published a binary for your architecture.
Does a patched result mean the server is safe?
It means the pasted version matches our recorded PHP2Shell threshold. It cannot verify a running server, extensions, configuration or compromise. Confirm installed packages and serving processes with your administrator.