WP Engine is managed WordPress hosting. Each environment's PHP version is set with the PHP Selector in the User Portal. For PHP2Shell, see which version your site runs in User Portal (steps below), then ask WP Engine to confirm the fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) or a patched package is applied.
- where PHP settings live
- User Portal
- newest PHP2Shell fix
- 8.5.12
How to see your PHP version on WP Engine
- Open the Sites page in the User Portal.
- Select the environment name.
- Within the Updates section, locate PHP to see the current version.
How to change your PHP version on WP Engine
- Open the Sites page in the User Portal.
- Select the environment name.
- Within the Updates section, locate PHP.
- Click the PHP Version number.
- Select a new PHP version.
- Click Confirm.
Who updates PHP on WP Engine?
WP Engine says you pick each environment's PHP version, and that it removes PHP versions from its servers once they reach end of life and automatically upgrades those sites, which cannot be deferred. Ask WP Engine whether the latest PHP security release is applied.
Good to know
- WP Engine says the PHP Selector is in 2 places in the User Portal; its guide spells out only the Overview page path above.
- Before switching, WP Engine's PHP Test Driver (Preview PHP on the Sites page) shows the site on a new version in your browser only.
- PHP version is not copied when you copy an environment, so set it again on the copy.
- WP Engine rolls out new PHP versions gradually, so a new version may not appear for every environment right away.
- If you make a phpinfo page, WP Engine recommends a random file name and deleting it as soon as possible.
An email to send WP Engine
If you can't find the version, or you want written confirmation that the fix is in, send this to their support team:
Subject: Is our PHP patched for PHP2Shell? Hi WP Engine support, PHP released security fixes on October 21, 2026 for 2 critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Which exact PHP version does our site run on, and does it include the fix (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or a patched package)? If not, when will it be applied? Thanks,
Questions people ask
Has WP Engine patched PHP2Shell?
We don't know, and we don't guess: ask WP Engine with the email above. PHP's fixed releases are 8.2.35, 8.3.36, 8.4.27, 8.5.12.
How do I update PHP on WP Engine?
Open the Sites page in the User Portal. The full steps are above, from WP Engine's own help pages.
Which PHP version should I pick on WP Engine?
The newest one your platform, theme and plugins support. For most WordPress sites that's PHP 8.3 or newer; test on a staging copy first if your host offers one.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.