Am I affected?

Who is affected

Reports suggest that a wide range of PHP versions is affected. The PHP project publishes the exact affected and fixed versions with its security release. Until you have checked your versions against that list, treat every PHP installation as affected. That includes:

• websites and web shops built on PHP, such as WordPress, WooCommerce, Magento, Drupal, Joomla, Laravel and Symfony applications
• tools that use PHP, such as phpMyAdmin, Roundcube or a control panel on your own server
• cloud servers and VPSs with PHP installed, even if no website uses it right now
• software and appliances from third parties that bundle PHP

Hosting that PeaceWeb manages

Where PeaceWeb manages PHP for you, we patch it. You don't need to check the PHP version yourself. Do check the applications you installed yourself for signs of compromise.

Check the PHP version on a server

A server can have several PHP versions next to each other, and the web server may use a different version from the command line. Check all of them.

php -v

ls /etc/php/
systemctl list-units --type=service | grep -i php

rpm -qa | grep -i php
systemctl list-units --type=service | grep -i php

<?php echo PHP_VERSION;

Put this one line in a file with a random name in your web root, open it in your browser, and delete the file right away.

Check from your application or control panel

• WordPress: Tools › Site Health › Info › Server.
• cPanel: MultiPHP Manager.
• Plesk: Websites & Domains › PHP for each domain.
• Other software: the system or server information page in the admin area usually shows the PHP version.

Make your list

For every system, write down:

• its name and who manages it
• the PHP version or versions, and how PHP runs (PHP-FPM, Apache module or command line only)
• whether it is reachable from the internet
• how critical it is for your business

Patch or shield the systems that are reachable from the internet and critical first.