Find the PHP runtime serving WordPress
Use Tools → Site Health → Info → Server in your WordPress dashboard. This view identifies the website runtime; a local terminal can report a different installation. Follow the linked WordPress Site Health documentation.
Ask the host to confirm the package update
A WordPress application update does not replace the PHP runtime. Ask your administrator to identify the vendor package, apply the PHP vulnerability update, restart PHP workers, and confirm the runtime used by this site.
Back up and test plugins, themes and critical workflows before changing PHP branches. Use the platform guide for the server or panel your host uses.
Managed hosting instructions
These vendor help pages explain version management; they do not independently establish a PHP2Shell package fix.
Kinsta: vendor instructions ↗
Use the site's Tools page to change its PHP settings. Test a staging environment first.
Checked at 2026-10-21 15:38:57 UTC
SiteGround: vendor instructions ↗
Review Managed PHP and manual version management in Site Tools. Ask support to confirm the exact patched build.
Checked at 2026-10-21 15:38:59 UTC
Verify the PHP security update
After the host completes the PHP vulnerability update, check Site Health again, verify frontend and admin requests, and confirm background tasks still run. A PHP version alone does not establish a backported package fix; request the complete revision.