LoveEasyToolEveryday utility
Security Advisory · CVSS 9.2 Published: October 23, 2026 8 min read By Ali Hassan

How to Check Your PHP Version and Update Safely (After the October 2026 Vulnerabilities)

On October 21, 2026, the official PHP development team released coordinated emergency security updates to mitigate two critical vulnerabilities—cataloged as CVE-2026-109618 and CVE-2026-109619. Carrying a near-maximum CVSS v4.0 score of 9.2, these flaws enable unauthenticated remote attackers to execute arbitrary system code on vulnerable servers without requiring login credentials.

Companion Guide:Is My Website Affected? Quick Audit Checklist

Understanding the October 21, 2026 Emergency Disclosure

The global web infrastructure runs overwhelmingly on PHP—powering over 75% of content management systems including WordPress, Drupal, Joomla, and Magento (Adobe Commerce). When an unauthenticated Remote Code Execution (RCE) flaw strikes the core interpreter, the blast radius is instantaneous.

Following the disclosure of CVE-2026-109618 and CVE-2026-109619 on October 21, 2026, several national cybersecurity authorities and government digital departments across Europe, North America, and Asia took public-facing portals offline as a protective precaution while server fleets were audited and patched. Because these two critical vulnerabilities carry a near-maximum CVSS 9.2 score and enable unauthenticated remote code execution, proactive patching is mandatory for every webmaster and system administrator.

Official patches and release notes are published directly at the official PHP website (php.net) . Below is your comprehensive technical walkthrough to identify your current version, apply official updates safely, and isolate servers if upstream binaries are delayed.

Part 1: Four Methods to Check Your Active PHP Version

Never assume the PHP version displayed in your hosting billing receipt matches what your web server executes. Use one of these four verified inspection methods to confirm your running runtime.

Method A: Command Line Interface (CLI) via SSH

VPS & Dedicated

Connect to your virtual or dedicated machine via SSH and run the CLI version command:

$ php -v

Important Caution: On servers running PHP-FPM or multiple installed PHP engines, the CLI executable might differ from the FastCGI process serving web traffic. To verify the active FPM socket version, inspect your system services: systemctl status php*-fpm or check your Nginx/Apache VirtualHost configuration.

Method B: Creating a Temporary phpinfo() File

Shared Hosting

If you do not possess SSH terminal access, create a test script in your document root (e.g. public_html/test-php-info.php):

<?php phpinfo(); ?>

Open https://yourdomain.com/test-php-info.php in your browser. Inspect the large banner at the very top: it details the exact version number, build date, and loaded security modules. Critical Security Warning: Delete this file immediately after checking. Leaving a public phpinfo() file exposes your server environment, internal file paths, and environment variables to malicious crawlers.

Method C: Hosting Control Panel (cPanel, Plesk, Cloudways)

Control Panel

Most modern commercial hosting environments provide a visual PHP configuration tool:

  • cPanel: Navigate to the Software section → click Select PHP Version or MultiPHP Manager. Review the version assigned to your domain.
  • Plesk: Open Websites & Domains → click PHP Settings beside the selected domain.
  • SiteGround / Hostinger / Cloudways: Access the Site Tools or Application Settings tab and locate the PHP Version Switcher.

Method D: WordPress Native Site Health Tool

WordPress Users

If you manage a WordPress site, you can view the active web server PHP build directly from the admin dashboard without writing any code:

  1. Log in to your WordPress administration dashboard (/wp-admin).
  2. In the left sidebar, click Tools → Site Health.
  3. Click on the Info tab at the top.
  4. Expand the Server dropdown menu.
  5. Read the PHP version row. This reports the exact runtime binary handling live visitors.

Part 2: Step-by-Step Safe Upgrade Procedures

Updating your runtime must follow a defensive staging protocol. Jumping versions blindly without checking database and extension dependencies risks application downtime.

The Mandatory Pre-Update Safety Checklist

Full Database Backup: Export your SQL database (via mysqldump or phpMyAdmin).
Filesystem Snapshot: Archive all source files, themes, and uploaded media.
Extension Audit: Confirm active extensions (e.g. curl, mbstring, gd, sodium, intl) remain enabled after upgrade.
Staging Validation: Test mission-critical user checkout, login, and webhook flows on a staging clone first.

A. Upgrading on Shared or Managed Cloud Hosting

In managed environments, the underlying server software is maintained by the hosting provider. Your responsibility is switching your site to use the patched release profile:

  1. Log in to your hosting account control panel.
  2. Locate the MultiPHP Manager, PHP Selector, or PHP Version Settings.
  3. Select the newest patched maintenance build within your active branch (e.g. latest 8.3 or 8.2 point release containing the October 21 security patch).
  4. Click Apply or Save.
  5. Clear all caching plugins, Redis/Memcached object caches, and CDN edge caches (Cloudflare, Fastly).
  6. Browse your frontend in an Incognito window to confirm stylesheets, forms, and shopping carts operate normally.

B. Upgrading on a VPS, Cloud Instance, or Dedicated Server

If you run an unmanaged Ubuntu, Debian, or RHEL/Rocky Linux instance, upgrade the packages via your OS package manager:

Ubuntu & Debian (apt)

# 1. Update repository metadata
sudo apt update

# 2. Upgrade PHP core packages and FPM
sudo apt install --only-upgrade php php-fpm php-cli php-common

# 3. Restart PHP-FPM service (adjust for your active version, e.g. php8.3-fpm)
sudo systemctl restart php8.3-fpm

# 4. Gracefully reload your web server
sudo systemctl reload nginx
# or: sudo systemctl reload apache2

RHEL, CentOS, Rocky Linux & AlmaLinux (dnf / yum)

# 1. Check for upstream security packages from Remi repository
sudo dnf check-update

# 2. Upgrade PHP binaries
sudo dnf upgrade php php-fpm php-cli

# 3. Restart PHP-FPM and reload web daemon
sudo systemctl restart php-fpm
sudo systemctl reload nginx

Out-of-Support Versions (PHP 5, 6, 7, and Older 8.x): Migration Required

It is critical to note that PHP versions that are out of support—including PHP 5.x, PHP 6 (unreleased), PHP 7.0 through 7.4, and older unsupported 8.x releases such as PHP 8.0—did not receive official upstream security patches in the October 21, 2026 release cycle.

For these End-of-Life branches, there is no single point update or minor package patch available. Sites running these obsolete releases require a full migration to a currently supported release branch (PHP 8.1, 8.2, or 8.3). Before updating production environments, audit your application code and third-party plugins for deprecated syntax, verify database extension compatibility, and test all critical workflows on a staging server.

Part 3: CMS Considerations (WordPress, Drupal, Joomla, Magento)

WordPress Ecosystem

WordPress core natively supports PHP 8.1, 8.2, and 8.3. When updating between minor security builds (e.g., from an unpatched 8.2.x build to the patched 8.2.y build), no theme or plugin incompatibilities occur. If you are upgrading from outdated PHP 7.4 or 8.0, run the PHP Compatibility Checker plugin first to ensure your active plugins do not invoke deprecated syntax.

Drupal (10 & 11)

Drupal 10 and 11 require modern PHP (PHP 8.2+ recommended). After updating the server binary, rebuild Drupal caches via Drush (drush cr) to invalidate compiled container classes and verify Twig template generation.

Joomla! (4 & 5)

Joomla 5 fully supports PHP 8.2 and 8.3. Verify third-party extensions in the Extensions Manager prior to major version switches, and check that the MySQLi or PDO MySQL drivers remain cleanly linked.

Magento / Adobe Commerce

Magento is notoriously sensitive to PHP version boundaries (e.g. Magento 2.4.6 requires specific PHP 8.1 or 8.2 patch levels). Upgrading point security releases within the certified branch is safe, but always recompile code (bin/magento setup:di:compile) and clear varnish caches.

Part 4: Emergency Mitigation If You Cannot Update Immediately

If your host has not yet mirrored the official October 21 packages, or if legacy software prevents an instant version bump, apply these emergency mitigation controls immediately:

1. Place Application Behind an Edge Proxy or Firewall

Routing traffic through an edge reverse proxy or Web Application Firewall provides an initial defensive perimeter for your origin server while package updates are scheduled and tested. However, edge filtering is a temporary shield and does not eliminate the requirement to install the official PHP 21 Oct 2026 patches.

2. Restrict Administration Routes via IP Whitelisting

Block public access to /wp-admin, /administrator, /user/login, or custom portal paths using .htaccess or Nginx location blocks. Allowing only designated office or VPN IP addresses limits attacker reconnaissance opportunities.

3. Temporary Maintenance Mode for Critical Endpoints

If threat intelligence shows active exploitation in your industry sector and no WAF is available, consider placing sensitive transactional pages in maintenance mode until your hosting provider deploys the October 21 upstream patches. This mirrors the defensive stance adopted by several public government portals.

Frequently Asked Questions (FAQ)

Direct answers to frequent inquiries regarding the October 2026 PHP vulnerabilities and update management.

How do I check what PHP version my website is actually executing?

You can check your active PHP version using several methods: run "php -v" in your server command line, upload a temporary "phpinfo.php" script containing "<?php phpinfo(); ?>", check the PHP Selector section in your hosting cPanel or Plesk dashboard, or navigate to Tools > Site Health > Info > Server in WordPress.

Why did October 21, 2026 PHP updates require emergency patching?

The PHP development team released emergency updates addressing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a CVSS v4.0 severity rating of 9.2. These bugs allow unauthenticated remote attackers to trigger arbitrary code execution on vulnerable web servers without requiring credentials or administrative access.

Can updating PHP break my existing WordPress, Drupal, or Joomla site?

Upgrading between minor maintenance releases within the same release series (for example, updating from an unpatched 8.3.x build to the patched 8.3 point release) carries virtually zero breaking changes. Moving across major versions (e.g., PHP 7.4 or 8.0 to 8.3) may introduce deprecations if outdated plugins or themes are installed. Always create a full database and filesystem backup before updating.

What should I do if my hosting provider has not yet made the patched PHP version available?

If your host has not deployed the patched binary, place your web application behind a managed Web Application Firewall (WAF) with updated virtual patches, isolate your server by disabling direct CGI/FastCGI exposure, temporarily restrict admin endpoints by IP address, or activate maintenance mode for public forms.

Why were government websites taken offline following the October 21 disclosure?

Because CVE-2026-109618 and CVE-2026-109619 permit unauthenticated remote code execution with a CVSS score of 9.2, several national security agencies and digital ministries took non-critical public portals offline as a protective isolation measure while system administrators verified and compiled emergency patches across internal server fleets.

Next Security Step

Is Your Website Affected by the October 2026 Vulnerabilities?

Run through our 5-point vulnerability triage checklist to verify your web server exposure, runtime environment, and update status.

Open Audit Checklist