After a PHP security update, you sometimes still see exactly the same PHP version number as before. That is not an error: your PHP has been updated. This article explains why and how to check for yourself that the security update is installed.

Why does the version number stay the same?

At Theory7, you choose your PHP version in DirectAdmin via Select PHP version. These PHP versions are supplied and maintained by CloudLinux, the operating system on our web servers. When a security vulnerability in PHP comes to light, CloudLinux includes the fix in a new build of the same version. So the version number stays the same, but the software has been replaced.

An example: PHP 8.3.35 is still PHP 8.3.35 after the update, but then runs with the security fix.

You only see a new version number, such as 8.3.36, for the server's default PHP version. Both variants contain the same security fix.

How to check that the update is installed

You can recognize an updated PHP version by its build date: the date on which that version was built. After an update, that date is newer than before.

Using a phpinfo file

  1. In the public_html folder of your website, create a file, for example info.php, with this content: <?php phpinfo();
  2. Open the file in your browser, for example https://jouwdomein.nl/info.php.
  3. Look at Build Date near the top. It shows the build date of the PHP version your website uses.
  4. Delete the file afterward. A phpinfo page shows a lot of technical details that you do not want to leave publicly visible.

Via SSH

If you have SSH access, type php -v. The build date appears after built:.

Note: via SSH, you see the command-line PHP version. It can differ from the version your website uses. The phpinfo method always shows your website's version.

Security update October 2026 (CVE-2026-109618 and CVE-2026-109619)

On October 21, 2026, security updates were released for two serious vulnerabilities in PHP. We installed those updates on all our web hosting servers and then checked them server by server. You do not need to do anything.

  • Does Build Date show October 21, 2026 or later? Then your website is running with the security fix.
  • CloudLinux has also released a security fix for PHP 8.1 and older, and we have installed it. Even so, we recommend switching to PHP 8.2 or higher, because older versions do not get a fix for every future problem.

You can always find the current status of outages and maintenance at status.theory7.net.

Changing your PHP version

Want to switch to a newer PHP version? You can do that yourself in DirectAdmin via Select PHP version. Test your website thoroughly after switching, because older plugins or themes sometimes do not work with a new PHP version.

Still not sure?

Does Build Date show a date before October 21, 2026, or are you not sure which PHP version your website uses? Then create a ticket and include your domain name. We will check it for you.

Looking for web hosting plans? View our plans.