PHP Site AuditVerification
A PHP version banner is a clue, not a vulnerability verdict
A PHP response header can expose a version string, but the string alone cannot establish whether the serving package is vulnerable. Administrators can suppress or customize banners, intermediaries can alter them, and vendors may backport fixes without using upstream version numbers. Treat a banner as a lead and confirm the deployed runtime with the provider.
Why the string can mislead in either direction
A server may disclose a PHP version in X-Powered-By, but PHP provides an expose_php setting to reduce information in responses. Sites can also customize headers. That means no visible PHP banner does not establish that PHP is absent or current.
An old-looking version string is not automatically proof that a downstream package lacks a patch. The PHP project explicitly notes that Linux distributions and LTS vendors may backport fixes and asks users of older branches to consult their vendor. The reverse is also true: a reassuring-looking banner is not package evidence.
How to verify a security fix
For PHP2Shell, compare the upstream release with the package or build used by the web-serving SAPI. If the host runs a vendor build, ask for the vendor advisory that covers CVE-2026-109618 and CVE-2026-109619 and the installed package release. Ask when the relevant PHP-FPM, Apache, CGI, or container workers restarted.
Use an approved administrative interface or service inventory to check; do not expose a public phpinfo() endpoint. PHP's manual explains that phpinfo() can reveal configuration values, environment information, paths, headers, and request variables.
If the text names an old build, capture the response path and timestamp, then ask the provider to explain the corresponding package. If no version appears, ask the same package question; hiding a header does not remove the need to verify the runtime.
How a scanner should phrase the result
Report the exact observed header, response, and timestamp. Say that the version signal may warrant verification, or that no version signal was observed. Do not label the domain vulnerable or patched from a header alone. The report can explain what evidence would resolve the question so the owner knows what to request next.
Common questions
Does a PHP 8.2.35 banner prove the host is patched?
It is a clue, not package attestation; it can be customized or describe a different runtime. Request vendor and deployment evidence.
Does hiding the banner make a site safe?
No. Hiding a version removes a disclosure signal but does not update PHP or prove patch status.
Can a backport keep an older version string?
Yes. Some vendors preserve branch numbering while applying fixes, so consult the package advisory.