diff --git a/README.md b/README.md
index 13eb736..9757073 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,18 @@ run a playbook with sudo:
 ansible-playbook playbooks/<playbook_name>.yml -K
 ```
 
+check PHP versions on hosts and in running Docker containers:
+
+```bash
+ansible-playbook playbooks/phpcheck.yml
+```
+
+with sudo (e.g. if the user is not in the docker group):
+
+```bash
+ansible-playbook playbooks/phpcheck.yml -K -e phpcheck_become=true
+```
+
 ## WSL Setup Instructions
 
 To use Ansible on Windows, you need to set up Windows Subsystem for Linux (WSL).
diff --git a/playbooks/phpcheck.yml b/playbooks/phpcheck.yml
new file mode 100644
index 0000000..01a1c16
--- /dev/null
+++ b/playbooks/phpcheck.yml
@@ -0,0 +1,68 @@
+---
+- name: Check PHP versions
+  hosts: all
+  gather_facts: false
+  become: "{{ phpcheck_become }}"
+  vars:
+    phpcheck_become: false
+    phpcheck_oldest_branch: "8.2"
+    phpcheck_min_versions:
+      "8.2": "8.2.35"
+      "8.3": "8.3.36"
+      "8.4": "8.4.27"
+      "8.5": "8.5.12"
+  tasks:
+    - name: Get host PHP version
+      ansible.builtin.shell: command -v php >/dev/null 2>&1 && php -r 'echo PHP_VERSION;'
+      register: phpcheck_host
+      changed_when: false
+      failed_when: false
+
+    - name: Check if docker is installed
+      ansible.builtin.command:
+        argv: [sh, -c, command -v docker]
+      register: phpcheck_docker
+      changed_when: false
+      failed_when: false
+
+    - name: List running containers
+      ansible.builtin.command: docker ps --format '{% raw %}{{.Names}}{% endraw %}'
+      register: phpcheck_containers
+      changed_when: false
+      failed_when: false
+      when: phpcheck_docker.rc == 0
+
+    - name: Get container PHP versions
+      ansible.builtin.command:
+        argv: [docker, exec, "{{ item }}", php, -r, "echo PHP_VERSION;"]
+      loop: "{{ phpcheck_containers.stdout_lines | default([]) }}"
+      register: phpcheck_container_php
+      changed_when: false
+      failed_when: false
+      when: phpcheck_containers.rc | default(1) == 0
+
+    - name: Evaluate PHP versions
+      ansible.builtin.set_fact:
+        phpcheck_report: "{{ phpcheck_report | default([]) + [item.0 ~ ': ' ~ phpcheck_status] }}"
+      loop: >-
+        {{ [['host', phpcheck_host.stdout | default('')]]
+           + (phpcheck_container_php.results | default([]) | map(attribute='item') | map('regex_replace', '^', 'container ')
+              | zip(phpcheck_container_php.results | default([]) | map(attribute='stdout', default='')) | list) }}
+      vars:
+        phpcheck_version: "{{ item.1 | regex_search('^[0-9]+\\.[0-9]+\\.[0-9]+') | default('', true) }}"
+        phpcheck_branch: "{{ phpcheck_version.split('.')[:2] | join('.') }}"
+        phpcheck_status: >-
+          {{ 'none' if not phpcheck_version
+             else phpcheck_version ~ ' VULNERABLE (EOL)' if phpcheck_branch is version(phpcheck_oldest_branch, '<')
+             else phpcheck_version ~ ' UNKNOWN (no minimum defined)' if phpcheck_branch not in phpcheck_min_versions
+             else phpcheck_version ~ ' VULNERABLE (< ' ~ phpcheck_min_versions[phpcheck_branch] ~ ')'
+                  if phpcheck_version is version(phpcheck_min_versions[phpcheck_branch], '<')
+             else phpcheck_version ~ ' OK' }}
+
+    - name: Print PHP versions
+      ansible.builtin.debug:
+        msg: >-
+          {{ phpcheck_report
+             + (['docker: not installed'] if phpcheck_docker.rc != 0 else [])
+             + (['docker: not accessible (' ~ phpcheck_containers.stderr | default('') | trim ~ ')']
+                if phpcheck_docker.rc == 0 and phpcheck_containers.rc | default(0) != 0 else []) }}