My host says they patched, but the header still shows the old number. Who is right?

Probably both. Backported fixes keep the old version number. Ask the host for the package version or the date of the patch, or let us check the server itself.

Does Cloudflare or a firewall rule protect me?

It blocks the known attack patterns and buys time. It is not a fix, and PHP says so. Patch anyway.

Do I need to update WordPress too?

Not for this. The bug is in PHP, under WordPress. Keeping WordPress and plugins current is still the right habit, and it makes the PHP upgrade easier.

8.2.35 has the fix, but the whole 8.2 branch stops getting security fixes on December 31, 2026. If you are changing versions anyway, go to 8.3 or 8.4.

Is my PHP patched for PHP2Shell?

PHP2Shell is a pair of bugs in PHP itself, disclosed on October 21, 2026, that let an attacker run code on a server without logging in. Updating WordPress or your plugins does nothing for it; only a PHP update closes it. Here is how to find out where you stand and what to do about it.

The fixed versions

PHP released fixes on the supported branches only: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer. PHP 8.1, 8.0 and 7.4 got source patches that your host or Linux distribution has to build and ship; 7.3 and older have no fix at all. The official advice for anything that cannot be patched is to take it offline.

How to check

Run our free site check. When a server announces its PHP version in its response headers, the check reads it and tells you whether it is at or above the fixed release.
Open your hosting panel. cPanel has MultiPHP Manager, SiteGround has PHP Manager under Devs, Kinsta shows it under Tools, Hostinger under Advanced. The version shown there is the one your site runs.
On a VPS, run php -v and compare with the numbers above.
Ask your host for a written answer. A hidden version is not a safe version.

What the version number proves

At or above the fixed release for its branch: patched.
Below the fixed release on 8.2 to 8.5: unpatched, unless your host or distribution backported the fix under the old number. cPanel, Debian and Ubuntu all do that, so ask before you assume the worst.
8.1 or older: the number cannot tell you. Only your host's word, or an upgrade to 8.3 or 8.4, settles it.

What to do, by where you host

Managed WordPress and most shared hosting (Kinsta, SiteGround, WP Engine, Hostinger web and cloud plans, GoDaddy Managed WordPress): the host patched at the platform level within a day or two. Confirm it and you are done.
cPanel shared hosting (GoDaddy web hosting, Bluehost, HostGator, Namecheap, A2): cPanel shipped backports, including for 7.4 to 8.1. Still move to 8.3 or 8.4 in MultiPHP Manager when you can; 8.2 stops getting fixes on December 31, 2026.
A VPS or dedicated server (Hostinger VPS, GoDaddy VPS, Bluehost VPS, DigitalOcean, Linode, Vultr, AWS): nobody patches for you. The PHP packages need updating, PHP-FPM restarting, the stopgap setting applied, and the server checked for signs that someone got in first.
An old PHP version your host will not patch: upgrade to 8.3 or 8.4 and fix what the upgrade breaks, which is usually one old plugin or theme.

Signs the hole was already used

PHP worker crashes in the server log around the attack dates.
An administrator account you did not create, or PHP files inside the uploads folder.
Files changed on dates nobody was working, or scheduled tasks you do not recognize.
An email from your host about abuse, outbound spam or malware.

If any of these are true, a patch alone is not enough; that is the hacked-site cleanup.

What we do

Our PHP update job patches or upgrades PHP to a version with the fix, makes sure the site and its admin work on it, fixes what the change broke with your OK, and checks the server for signs the hole was used. It is a fixed price, done within 24 hours of access, and charged only when you approve. If you are on a managed host that already patched, you do not need it, and we will say so.

Questions people ask

My host says they patched, but the header still shows the old number. Who is right?: Probably both. Backported fixes keep the old version number. Ask the host for the package version or the date of the patch, or let us check the server itself.
Does Cloudflare or a firewall rule protect me?: It blocks the known attack patterns and buys time. It is not a fix, and PHP says so. Patch anyway.
Do I need to update WordPress too?: Not for this. The bug is in PHP, under WordPress. Keeping WordPress and plugins current is still the right habit, and it makes the PHP upgrade easier.
Is PHP 8.2 enough?: 8.2.35 has the fix, but the whole 8.2 branch stops getting security fixes on December 31, 2026. If you are changing versions anyway, go to 8.3 or 8.4.