The PHP versions you choose in PHP Selector are CloudLinux builds, and a security fix can arrive as a new build of the same version, without changing the number you see. To check whether you run the fixed build, look at the Build Date in phpinfo. We apply the updates to every PHP version on the server, so you do not need to change version.
Why the version number stays the same
When a PHP vulnerability is announced, the PHP team releases new versions with a new number. CloudLinux, which provides the PHP Selector versions, can include the fix in its own package as a new build of the same version. The number you see, for example 8.3.x, stays the same, but the code that runs is fixed. What changes is the date the build was created.
The version number on its own, then, does not show whether your site is exposed.
How do I check the Build Date of my site’s PHP
The Build Date appears on the phpinfo page. To see it, you create a small temporary file and delete it right afterwards.
- Log in to cPanel.
- Open File Manager.
- Go to the public_html folder, or the folder of the domain you want to check.
- Click + File and give it a hard-to-guess name, for example check-7f3k.php.
- Right-click the file and select Edit.
- Enter only the line
<?php phpinfo(); - Click Save Changes.
- Open https://example.gr/check-7f3k.php in your browser, with your own domain.
- Look at the Build Date in the table at the top of the page.
- Delete the file from File Manager.
Do not leave the phpinfo file on your site. It shows settings and paths of your account to anyone who finds it.
How do I know my PHP is fixed
If the Build Date is later than the date the fix for the vulnerability was released, you are running the fixed build. For a specific vulnerability you can also open a ticket and we will confirm the build on your server.
What we do when a critical PHP vulnerability is announced
- We install the fixed CloudLinux packages on every PHP version on the server, not only the default one.
- We restart the PHP processes, so that sites immediately run the new build and not the old one still loaded in memory.
- When the fix has not been released yet, we apply the temporary measures recommended by the PHP team.
- We update the Imunify360 rules for the specific vulnerabilities, as a second layer of protection.
Do I need to change version in PHP Selector?
Not to get a security fix. The fix goes into the version you already use. Changing version is needed when your version is very old and no longer supported by PHP, or when your application requires it. See how to change the PHP version in cPanel.
Frequently Asked Questions
Why does the file address show a 404 error?
The file is not in the folder of the domain you opened. An addon domain or subdomain has its own folder, outside public_html.
Why does the page download as a file or show the code?
Check that the name ends in .php and that the first line is exactly <?php phpinfo();
Why does phpinfo show a different version from PHP Selector?
The site may set its version elsewhere, for example in MultiPHP Manager or with a line in .htaccess. See the difference in MultiPHP Manager or PHP Selector.