Your host says PHP 7.4. Here’s what that means and what to ask.

If your website is WordPress, it runs on PHP. Each PHP version gets security fixes for a few years and then stops. After that, any new flaw stays open for good.

On October 21, 2026 the PHP project published fixes for two critical flaws, called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can let a stranger run their own code on a server. The fixes went out for PHP 8.2, 8.3, 8.4 and 8.5. PHP 8.1 and older got nothing, because they’re past their end of support.

What we found locally

When we rechecked Grand Strand websites the week the fix came out, two sites that had been one release behind on a supported version were up to date a day later. Five others hadn’t moved, and couldn’t: one reported PHP 5.6, which stopped getting fixes at the end of 2018; two reported PHP 7.4, which stopped in November 2022; and two reported PHP 8.1, which stopped at the end of 2025.

That’s the pattern worth understanding. A supported version gets patched quietly. An unsupported one sits still, because there’s nothing to install.

Find your version

1. Use our free checkType your site into the server version check. If your server announces its PHP version, we’ll show it and say whether it’s still supported.
2. Or look in WordPressIn your dashboard, open Tools, then Site Health, then Info, then Server. The PHP version is listed there even when the server hides it from visitors.
3. Or ask your hostEvery hosting control panel shows it, usually under something like PHP settings or Software.

The caveat, and why it matters

Some hosting platforms sell their customers patched builds of old PHP versions and keep the old number. A server that reports 7.4.33 might have had this month’s fix backported to it, or it might not. From the outside nobody can tell, which is why the right move is to ask, not to assume either way.

What to ask your host

• Which PHP version is my site actually running, and is it receiving security updates? If it’s 8.1 or older, where do those updates come from?
• Is the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619) applied to the PHP my site uses?
• Which newer PHP versions can I switch to on my plan, and can you make a test copy of my site first?
• Is my site isolated from the other sites on the same server? If one of them is broken into, can it reach mine?

How an upgrade goes without breaking anything

1. Make a test copyMost hosts can clone your site to a staging address. Do everything there first.
2. Update everything else firstWordPress itself, then every plugin and the theme. Old plugins are what break on new PHP, so remove anything you don’t use.
3. Switch the test copy to PHP 8.3 or 8.4Then click through every page that matters: the contact form, any booking or checkout, anything that sends email.
4. Switch the real site and watch it for a dayIf something breaks, switching back takes a minute. Then fix the plugin that broke and try again.

If the site is old enough that the theme won’t run on a supported PHP at all, you’ve reached the point where the site can’t be kept safe as it is. That’s when a rebuild stops being a nice-to-have.