How to Update PHP Version and Apply the PHP2Shell Patch

To update your PHP version for PHP2Shell, install the fixed release for the branch your site runs: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Shared hosting needs only the panel or one support ticket. Your own server needs a package update, then a restart so no PHP worker keeps the old code loaded.

Updating WordPress, your theme or your plugins doesn't touch PHP. PHP runs on the server, so the fix sits with whoever controls your hosting. A separate guide covers what the PHP2Shell vulnerability is and who it affects.

On this page

• Which PHP releases include the PHP2Shell patch?
• How to check PHP version on your site
• How to update PHP in cPanel
• Update PHP in Plesk or through your host
• Commands to update PHP version on a VPS or Windows server
• Restart PHP and confirm the fix
• What to do before and after the update
• If you can't update PHP today
• Supported PHP versions and end-of-life dates
• When to plan a PHP 8.4 upgrade
• Get help with a PHP version update

Which PHP releases include the PHP2Shell patch?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 carry the PHP2Shell patch. All four shipped on October 21, 2026. PHP's security announcement asks every PHP user to update immediately and says there are no complete mitigations.

The patch closes two flaws, CVE-2026-109618 and CVE-2026-109619, and PHP rates both 9.2 out of 10 on CVSS v4.0. The risk is highest on Apache with mod_php. There, a demonstrated exploit works for a visitor who isn't logged in, before any of your site's code runs.

Attackers moved early. Amazon's threat intelligence team logged an attempt on its MadPot honeypot on October 17, four days before the patch, and watchTowr reported active exploitation attempts against both flaws on release day. When The Hacker News last updated its report, no source had confirmed a break-in on a specific server. The full timeline is in how hackers got a four-day head start on PHP2Shell.

How to check PHP version on your site

Read the full three-part number, such as 8.3.14, because the last part tells you whether the patch is in. Anything older than the patched release for its branch needs the update, unless your Linux distribution patched its own package.

• WordPress and WooCommerce: open Tools, then Site Health, and switch to the Info tab. The Server section lists the PHP version.
• cPanel shows the version each domain uses under Software, then MultiPHP Manager.
• In Plesk, go to Websites & Domains and open PHP settings for the domain.
• A phpinfo page prints the version at the top. Delete it as soon as you've read it, since it shows your server settings to anyone who finds the address.
• The command php -v reports the command-line PHP. That can differ from the PHP serving web pages, so confirm with one of the other methods.

Ubuntu needs one more check, because it patches PHP inside its own packages and keeps the old upstream number. Ubuntu's page for CVE-2026-109619 lists 8.3.6-0ubuntu0.24.04.13 as the fixed package on 24.04 LTS, so PHP still reports 8.3.6 with the fix in place. Debian moved to the new numbers: 8.4.27-1~deb13u1 on Debian 13 and 8.2.35-1~deb12u1 on Debian 12.

How to update PHP in cPanel

Shared hosts install the PHP builds themselves and let you pick the branch each domain uses. The patch arrives when the host updates its builds. Your job is to confirm that it happened and that your domain sits on a supported branch.

cPanel's MultiPHP Manager guide gives these steps to change a domain's version:

1. Open cPanel and go to Software, then MultiPHP Manager.
2. Select the checkbox for your domain.
3. Choose a version from the PHP Version menu. Versions your host recommends carry a Recommended label.
4. Click Apply. A domain running PHP-FPM switches to match.

If MultiPHP Manager is missing, your host may have switched it off in WHM's Feature Manager, so open a support ticket instead. A domain set to inherit uses the server's default PHP, which means you also need to know what that default is.

Change the branch here only if you're on 8.1 or older, and only after the backup and testing steps further down. A move from 7.4 to 8.4 can break plugins that a patch within 8.3 never touches.

Update PHP in Plesk or through your host

In Plesk, go to Websites & Domains, open PHP settings for the domain and pick the version from the menu. The PHP handler sits on the same screen. Plesk's documentation says to contact your hosting provider if the version you need is missing.

cPanel lists branch names such as PHP 8.3 rather than full numbers. The build behind that name comes from your host, so send one support message even when the panel looks right:

Please confirm that the PHP build serving my site includes the fixes for CVE-2026-109618 and CVE-2026-109619, either PHP 8.3.36 or your patched package, and that PHP-FPM and Apache were restarted after the update.

Swap 8.3.36 for the fixed number on your own branch before you send it. Keep the reply. It's your record of when the fix went live, and you'll want it if a client or insurer asks.

Commands to update PHP version on a VPS or Windows server

This part is for developers. Linux distributions and long-term support vendors got the patches before the public release, so check for their updated packages first. Rebuild from source only if you compiled PHP yourself, and on Windows replace the binaries with the fixed build.

If PHP came from a third-party repository such as Remi's, check that the repository has shipped the October 21 releases before you trust dnf to install them.

Restart PHP and confirm the fix

Restart everything that holds PHP in memory. Old workers keep running the vulnerable code until they stop, so a PHP version update isn't finished when the package installs.

On Debian and Ubuntu, start with sudo systemctl restart php8.3-fpm, using your own branch number. RHEL calls the service php-fpm. Restart Apache too when it loads mod_php (the service is apache2 or httpd). Long-running workers need the same treatment: Laravel queues with php artisan queue:restart, Supervisor jobs, RoadRunner and FrankenPHP.

Then load Site Health or a fresh phpinfo page and read the version that serves web requests. A correct number on the command line proves nothing about the web server.

What to do before and after the update

Take a full backup of files and database before you update the PHP version, and store a copy off the server. A security update inside your current branch is the urgent part, so apply it once the backup is done. A move to a new branch, such as 8.1 to 8.4, needs a staging test first. Plesk's PHP settings guide gives the reason plainly: different PHP versions are not 100% compatible.

Serve a 503 status code during the downtime if you take the site offline to patch, so Google treats the outage as temporary.

After the update, test the pages that bring in money or leads:

• the home page and the main product or service pages
• login, customer accounts and password reset
• contact and quote forms, plus the email that should arrive afterward
• search, cart and one full checkout with a test payment
• the admin area and scheduled jobs such as order emails or backups

Watch the PHP error log for the next few hours. A store that patches at 10 p.m. and runs a test checkout before bed finds a broken payment plugin that night, before a single customer does.

If you can't update PHP today

Set session.upload_progress.enabled=0 in php.ini, the PHP-FPM pool or the server configuration, then restart every worker. On PHP 8.5, also set fatal_error_backtraces=0. PHP says these steps reduce exposure to specific attack paths but do not make a server safe.

Don't rely on ini_set() or an FPM .user.ini file for this, because the setting has to apply before PHP parses the request. In an FPM pool file the line is php_admin_flag[session.upload_progress.enabled] = off. Upload progress bars built on this feature stop updating, but the uploads still work.

PHP's advisory for CVE-2026-109619 says no generic configuration change covers every path, and it suggests pm.max_requests=1 for FPM where performance allows. The upload setting also does nothing for CVE-2026-109618, which has its own interim steps in the announcement, such as a low post_max_size. Treat all of it as cover for a day while the real update is booked.

PHP added a note on October 23 about CVE-2026-115560, another upload progress issue. It needs an app that sets session.serialize_handler to php_binary or php_serialize, then switches it to php with ini_set() before session_start(). PHP calls this setup unlikely and recommends the same upload progress setting until its next release. If you applied it on October 21, there's nothing more to do.

Supported PHP versions and end-of-life dates

PHP 8.2, 8.3, 8.4 and 8.5 are the supported PHP versions, and only they get official PHP2Shell releases. Each branch gets two years of active support, then two more years of security fixes only, according to PHP's supported versions page.

The Hacker News reports that the flaws reach back as far as PHP 5.4, so an old branch offers no shelter. Some vendors still patch old branches: Ubuntu 22.04 LTS ships php8.1 8.1.2-1ubuntu2.28 with the fix, and Ubuntu Pro covers php7.4 on 20.04 LTS. For the rest, PHP's security team published minimal source backports for 7.4, 8.0 and 8.1, aimed at people who build from source or have no LTS vendor.

When to plan a PHP 8.4 upgrade

Start the PHP 8.4 upgrade now if your site runs 8.1 or older, and before December 31, 2026 if it runs 8.2. After that date, PHP 8.2 gets no more security fixes. If 8.2.35 is where you land this week, the next PHP flaw found in January gets no patch on your branch.

PHP 8.4 gets security fixes until December 31, 2028, and 8.5 until December 31, 2029. Pick the newest branch that every plugin, theme and extension on your site supports.

A branch move is a bigger job than a patch-level update, so check that support before you switch. WordPress plugin pages list a minimum PHP version. Composer-based apps such as Magento, Drupal and Laravel declare it in the php line of composer.json.

Then copy the site to staging, switch the copy to 8.4 and clear every deprecation warning in its log. Switch production in your quietest hour, with the backup from the day before on hand.

Get help with a PHP version update

To hand the job off, gather two details first: how the site is hosted (shared panel, VPS or Windows) and the full PHP version from Site Health or your panel. Those decide whether you update your PHP version with a host request, a package update or a branch move.

A new PHP build closes PHP2Shell, but it does nothing for holes in your own code. An old custom PHP site also needs a check for SQL injection in PHP forms and queries. An NDA is available on request, and you keep every account and every line of code.

Send those two details to our PHP upgrade team and get an answer within one business day.