How to check the PHP version that actually serves your site

Why php -v can give the wrong answer

A server can have several PHP installations at once: a command-line PHP, one or more PHP-FPM versions, an Apache module, a control-panel build, PHP inside containers. Your website uses whichever one your web server is wired to — and that may not be the one php points to in your shell.

Every major advisory for PHP2Shell repeats the same warning: check the runtime serving web requests, not the CLI and not your application’s version.

Check PHP-FPM (Nginx, Caddy, Apache + FPM)

List the PHP-FPM services running on the box, then ask the matching binary for its version:

systemctl list-units --type=service --state=running | grep -i fpm

# Debian / Ubuntu (versioned binaries)
/usr/sbin/php-fpm8.3 -v

# RHEL / AlmaLinux / Rocky
/usr/sbin/php-fpm -v

Or let our open-source checker read it and give a verdict in one line:

npx php2shell-checker@latest --local --php /usr/sbin/php-fpm8.3

Check Apache with mod_php

# Is a PHP module loaded?
apache2ctl -M 2>/dev/null | grep -i php     # Debian / Ubuntu
httpd -M 2>/dev/null | grep -i php          # RHEL family

# Which package provides it?
dpkg -l | grep libapache2-mod-php           # Debian / Ubuntu
rpm -q php                                  # RHEL family (mod_php ships in the php package)

Check from the website itself

If you can upload files but not log in to a shell, create a temporary file in your site’s web root:

<?php echo PHP_VERSION;

Open it in your browser, note the version, and delete the file immediately — don’t leave version information or phpinfo() pages online.

You can also look at response headers, but most production servers hide them (expose_php = Off), so an empty result tells you nothing:

curl -sI https://example.com | grep -iE 'x-powered-by|server'

Check in a hosting panel or CMS

• cPanel / WHM: MultiPHP Manager shows the PHP version per domain. cPanel guide
• Plesk: Websites & Domains → PHP for the domain.
• WordPress: Tools → Site Health → Info → Server shows the PHP version WordPress is running on — a good web-side check. WordPress guide
• Laravel: php artisan about reports the CLI PHP, not necessarily PHP-FPM. Use the FPM check above. Laravel guide

Check inside containers

# Running containers
docker ps --format '{{.Names}}\t{{.Image}}'
docker exec <container> php -v

# An image you're about to deploy
docker run --rm --entrypoint php <image> -v

Docker guide

Distro backports

If PHP came from your Linux distribution, the version number may stay the same after a security fix. Ubuntu 24.04’s PHP is 8.3.6, for example, yet it receives patches. Search the package changelog for the PHP2Shell CVE IDs instead:

# Debian / Ubuntu — replace 8.3 with your version
zgrep -E 'CVE-2026-10961(8|9)' /usr/share/doc/php8.3-common/changelog.Debian.gz

# RHEL / AlmaLinux / Rocky
rpm -q --changelog php-common | grep -E 'CVE-2026-10961(8|9)'
dnf updateinfo list --cve CVE-2026-109618

A match means your installed package contains the fix. No match means you either haven’t installed the update yet, or your vendor hasn’t published it — check their security tracker.

Did you restart PHP after upgrading?

Upgrading the package isn’t enough on its own. Running PHP-FPM, Apache and LiteSpeed workers keep the old code in memory until they restart. Check when the service last started:

systemctl status php8.3-fpm | grep Active

If that time is before your upgrade, restart it (sudo systemctl restart php8.3-fpm, or apache2 / httpd for mod_php).

Next steps

Found a vulnerable version? Pick your patch guide. Already patched? Run through the compromise checklist — attacks began before the fix was public.