Knowing which PHP version your application uses is an important part of keeping it secure. An application may work correctly for months while running an outdated PHP release that no longer receives security fixes. If a vulnerability affects that release, your application could remain exposed even when its own code has not changed.
The problem is that the PHP version installed on your computer may be different from the version running on your production server. Command-line tools, web servers, Docker containers, and hosting platforms can all use different PHP installations.
In this article, we will look at how to check the PHP version used by your application, determine whether it still receives security updates, investigate known vulnerabilities, and plan an upgrade without unnecessarily disrupting production.
Why Your PHP Version Matters for Security
PHP receives maintenance and security updates throughout its supported lifecycle. When a release branch reaches the end of security support, newly discovered vulnerabilities may no longer receive fixes for that branch.
Running an unsupported version does not automatically mean your application is vulnerable to every PHP security issue. However, it means you may not receive fixes for newly discovered problems affecting that release.
Your application's security also depends on its framework, third-party packages, server configuration, and application code. Checking the PHP version is therefore an important first step, not a complete security assessment.
Before making any changes, identify the PHP version used by each environment, including development, testing, staging, and production.
Step 1: Check the PHP Version from the Command Line
The simplest way to check your installed PHP version is to open a terminal and run:
php -v
Example output:
PHP 8.3.12 (cli) (built: ...)
Copyright (c) The PHP Group
The version shown in this example is illustrative. Your output will depend on your installation.
The output identifies the PHP version used by the command-line interface, commonly called the CLI.
You can also inspect the executable path:
which php
On Linux and macOS, this helps identify which PHP executable your shell finds first. On Windows, use:
where.exe php
If several PHP installations exist on your machine, the executable selected through your PATH may not be the one used by your web server.
For example, your terminal might use PHP 8.3 while your web application runs through a PHP-FPM service configured with PHP 8.2. Always verify the version in the environment that actually serves requests.
Step 2: Check the PHP Version Used by Your Web Application
The PHP version reported by the command line does not necessarily match the version used by Apache, Nginx, or a hosting platform.
To check the version used by a web request, you can temporarily create a PHP file containing the following code:
<?php
echo PHP_VERSION;
Save it as version-check.php and access it through your application's web server.
The output shows the PHP version used to execute that request.
Remove the file immediately after checking the version. Do not leave diagnostic files accessible on a production server unless they are properly protected.
For more detailed information during local development, you can use:
<?php
phpinfo();
This displays extensive configuration information, including loaded extensions, configuration files, and server details. However, it can expose sensitive information about your environment. Use it only in a controlled environment and remove it when you finish testing.
For production troubleshooting, prefer your hosting control panel, deployment configuration, or server administration tools when they can provide the required information safely.
Step 3: Determine Whether Your PHP Version Still Receives Security Updates
After identifying the version, check whether its release branch is still supported.
PHP maintains separate release branches, and each branch has a defined support lifecycle. A branch generally receives active support first, followed by a security-fixes period, and then reaches end of life.
The exact dates differ by release branch, so do not assume that every PHP version receives updates for the same length of time.
Follow these steps:
Record the complete PHP version, including the patch number.
Identify its major and minor release branch, such as PHP 8.3.
Check the official PHP release lifecycle information.
Confirm whether the branch is in active support, security-only support, or end of life.
Check the latest available patch release for that branch.
Compare your installed version with the latest applicable release.
For example, an application running PHP 8.3.12 may require an update even if the PHP 8.3 branch remains supported. A later patch release may contain security fixes and other corrections that are missing from the installed version.
The key is to check both the support status of the release branch and the patch level installed on your server.
Step 4: Check Known PHP Vulnerabilities
A supported PHP version is not automatically free from security issues. You should also investigate vulnerabilities affecting the exact version you run.
Start by identifying the installed version and reviewing official PHP security announcements. Then check reputable vulnerability databases for matching advisories.
When reviewing a vulnerability, pay attention to these details:
Detail | Why it matters |
|---|
Affected versions | Determines whether your installed version falls within the vulnerable range |
Fixed versions | Identifies releases containing the correction |
Severity | Helps assess the potential impact |
Required conditions | Explains what an attacker would need to exploit the issue |
Available mitigation | Identifies temporary protections when an immediate upgrade is not possible |
Do not assume that a vulnerability affects your application merely because its title mentions PHP. Some issues require particular extensions, configurations, or application behavior.
Likewise, do not dismiss a vulnerability just because your application does not directly call the affected function. A framework or third-party package may use it indirectly.
Record relevant advisories and the action taken so that your team can track unresolved security issues.
Step 5: Check PHP Dependencies for Security Issues
PHP itself is only one part of the application. Frameworks and packages can contain vulnerabilities independently of the PHP runtime.
If your project uses Composer, inspect its dependencies:
composer show --direct
This lists the project's direct dependencies.
To check for known security advisories affecting dependencies, use:
composer audit
Run these commands from the project directory containing composer.json and composer.lock.
The audit command checks installed dependency information against the configured advisory data. Its findings depend on the available advisory sources and the versions recorded in the project.
Review each finding before updating packages. A fix may require changing a package version, updating a framework, or resolving a dependency conflict.
Avoid running a broad dependency update in production just to clear an audit warning. Make the required changes in development, run tests, and deploy through your normal release process.
Step 6: Plan a Safe PHP Upgrade
If your application uses an unsupported PHP branch or a vulnerable patch release, plan an upgrade.
The safest approach depends on the size of the version change. Updating to a newer patch release within the same supported branch may require fewer changes than moving to a newer major version.
Start by reviewing the application's framework requirements, Composer dependencies, PHP extensions, and deployment configuration.
Then follow this process:
Identify a supported PHP version compatible with your application.
Review the migration notes for the target release.
Check framework and package compatibility.
Upgrade PHP in a development or test environment.
Run automated tests and inspect application logs.
Verify database connections, scheduled jobs, file uploads, and external integrations.
Deploy to staging and repeat the important application checks.
Roll out the change to production using a tested deployment and rollback plan.
Pay particular attention to removed or changed language features, extension availability, and differences between CLI and web-server configurations.
For applications that handle payments, personal information, or other sensitive data, include security-related regression tests in the upgrade process.
Common Mistakes to Avoid
One common mistake is checking PHP only through the terminal. This can produce a false sense of security if the web server uses a different version.
Another is treating the major version number as the complete security status. Patch releases can contain important fixes, so the complete version matters.
Do not assume that installing a new PHP version automatically switches your application to it. You may need to update Apache modules, PHP-FPM configuration, container images, hosting settings, or deployment scripts.
Finally, do not ignore dependency vulnerabilities while focusing exclusively on the runtime. A supported PHP installation can still run an application with vulnerable Composer packages.
Best Practices for PHP Security Maintenance
Use a regular process to keep track of runtime versions and security updates.
Maintain an inventory of PHP versions used across development, staging, and production.
Track release lifecycle dates and plan upgrades before support ends.
Apply supported patch updates after appropriate testing.
Run Composer security audits as part of development and CI/CD checks.
Keep framework versions and PHP extensions compatible with the selected runtime.
Use automated tests to detect compatibility problems before deployment.
Restrict access to diagnostic tools and remove temporary version-check files.
Document upgrade decisions, test results, and unresolved vulnerabilities.
For teams maintaining several PHP applications, automation can help identify outdated runtimes before they become urgent maintenance problems.
Advantages and Limitations of Version Checks
Checking the PHP version is quick and provides an essential starting point for security maintenance. Combining version checks with release lifecycle information and dependency audits gives developers a clearer view of potential risks.
However, version checks alone cannot prove that an application is secure. They do not detect every application-level vulnerability, unsafe server setting, compromised dependency, or access-control problem.
Use version information as one part of a broader security process that includes dependency management, code review, testing, and secure deployment practices.
Summary
To check your PHP security status, first identify the version used by both the command line and the web application. Confirm whether the release branch still receives security updates, check for newer patch releases, and investigate advisories affecting your installed version.
Also review Composer dependencies with the appropriate security audit tools. If an upgrade is needed, test it outside production before deploying the change.
Keeping PHP and its dependencies updated reduces avoidable security risks and makes application maintenance more predictable. A repeatable checking process is more reliable than waiting until a vulnerability or compatibility problem forces an urgent upgrade.
Join the conversation! Your thoughts help the community grow.