How Do You Update Your PHP Version to Fix the PHP2Shell Flaw?

Check which PHP version your site runs, then move to the fixed release for that branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, all released on 21 October 2026. Make the change through your hosting panel, your host's support team or your server's package manager, then restart PHP so no worker keeps running the old code.

Those four releases close both holes in PHP2Shell, the name researchers gave to a pair of flaws inside PHP itself. PHP's security announcement of 21 October asks every PHP user to update immediately. Most owners never need a server command to update PHP version settings: a hosting panel or one support ticket does the job. The second hole, CVE-2026-109619, is the one explained below. It runs through a PHP feature that is on by default, even on sites that never use it.

What the second PHP2Shell flaw does

CVE-2026-109619 lets data from one visitor's request stay behind after PHP has freed the memory it lived in. The next request handled by the same PHP worker can then pick up that stale data. Security teams call this a use-after-free, and here it can let an attacker run code on your server without logging in.

PHP rates the flaw critical, with a CVSS v4.0 score of 9.2 out of 10. Its security advisory for CVE-2026-109619 also lists memory disclosure, which means an attacker can read data out of the server's memory. No account is needed: the advisory describes the attack as unauthenticated. Every PHP setup that serves web pages is in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP puts the highest risk on mod_php, where a demonstrated exploit fires before any of your own site's code runs.

The advisory names session upload progress as one confirmed attack path. This feature tracks how much of a file upload has arrived. The PHP manual on session upload progress explains that it starts tracking whenever a form POST includes a field named PHP_SESSION_UPLOAD_PROGRESS. The setting is on by default. A shop that has never shown a progress bar still runs this code the moment a request carries that field. The attacker is the one who writes the request.

How to check PHP version on your site

Read the full version number from WordPress Site Health, your hosting panel, a phpinfo page or the php -v command. Write down all three parts, such as 8.3.14, because the last part shows whether the security fix is in. Anything below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on its branch needs the update, unless your Linux distribution patched its own package.

• WordPress and WooCommerce: open Tools, then Site Health, switch to the Info tab and expand the Server section.
• cPanel shows the version each domain uses under Software, then MultiPHP Manager.
• In Plesk, go to Websites & Domains, find the domain and click PHP.
• A phpinfo page prints the version at the top. Ask your developer to create one, read it, then delete it straight away, because it shows your server settings to anyone who finds the address.
• On the command line, php -v prints the version of the command-line PHP. That can differ from the PHP serving web pages, so confirm with one of the other methods too.

Linux packages need one extra check. Distributions such as Ubuntu and Debian patch PHP inside their own packages, and some keep the old number. On Ubuntu 24.04 LTS the fixed package is 8.3.6-0ubuntu0.24.04.13, so the PHP version inside it still reads 8.3.6 even though the fix is in. Check the package changelog for CVE-2026-109619 rather than trusting the version string, as Debian advises. The exact commands sit in the developer section below.

Update PHP in cPanel, Plesk or through your host

On shared hosting, the host installs PHP and you pick the branch your site uses. Ask your host to confirm that a patched build for your branch is live and that PHP was restarted. Switch to a newer branch in the panel only if you're on 8.1 or older, and only after the checks in the backup section.

cPanel's own documentation gives these steps for MultiPHP Manager:

1. Open cPanel and go to Software, then MultiPHP Manager.
2. Select the checkbox for your domain.
3. Choose the version you want from the PHP Version menu.
4. Click Apply.

Your host can hide MultiPHP Manager through WHM's Feature Manager, so if it's missing, a support ticket is your route. In Plesk, the documented path is Websites & Domains, then PHP for your domain. Select the PHP support checkbox if it is clear, pick the version and the handler from the drop-down menus, and click OK.

If the panel lists branch names such as PHP 8.3 instead of full numbers, the build behind that name comes from your host. That is why the support message matters even when the panel looks right. A short one does it:

Please confirm that the PHP build serving my site includes the fixes for CVE-2026-109618 and CVE-2026-109619, either PHP 8.3.36 or your patched package, and that PHP-FPM and Apache were restarted after the update.

Swap 8.3.36 for the fixed number on your own branch before you send it.

Commands to update PHP version on a VPS, dedicated server or Windows

This part is for developers. On your own server, install the distribution's security update for PHP, restart PHP-FPM and the web server, then confirm the fix in the package changelog. Rebuild from source only if you compiled PHP yourself, and on Windows replace the binaries with the fixed build from php.net.

Restart everything that holds PHP in memory, because old workers keep the vulnerable code loaded until they stop. On Debian and Ubuntu that starts with sudo systemctl restart php8.3-fpm, using your own branch number, and on RHEL the service is php-fpm. Restart Apache as well when it loads mod_php (apache2 or httpd), plus long-running workers such as Laravel queue workers (php artisan queue:restart), Supervisor jobs, RoadRunner or FrankenPHP. Then load Site Health or a phpinfo page again and confirm that the version serving web requests is the fixed one.

What to do before and after the update

Take a full backup of files and database before you change anything, and store a copy off the server. The security update inside your current branch is the urgent part, so apply it as soon as the backup is done. A move to a new branch, such as 8.1 to 8.3, needs a staging test first: Plesk's documentation warns that different PHP versions are not 100% compatible.

Before a branch move, check that every plugin, theme, extension and module supports the target version. WordPress plugin pages show the minimum PHP version. Magento and Drupal extensions list theirs in release notes, and a Laravel or custom app declares it in the php line of composer.json.

After the update, test the pages that bring in money or leads:

• the home page and the main product or service pages
• login, customer accounts and password reset
• contact and quote forms, including the email that arrives afterwards
• search, cart and one full checkout with a test payment
• the admin area and scheduled jobs such as order emails or backups

Watch the PHP error log for the next few hours too. A store that patches at 10 pm and runs a test checkout before bed finds a broken payment plugin that night, before a single customer does.

If you cannot update PHP today

Switch off session upload progress with session.upload_progress.enabled=0 in php.ini, the PHP-FPM pool or the server configuration, then restart every PHP worker. On PHP 8.5, also set fatal_error_backtraces=0. PHP is clear that these interim steps reduce exposure and do not make a server safe.

Where you set it matters. PHP asks for a setting that is in place before the request is parsed and warns against relying on ini_set() or an FPM .user.ini file. In an FPM pool file, the line is php_admin_flag[session.upload_progress.enabled] = off. Any upload progress bar built on this feature stops updating while the setting is off, and the uploads themselves still work.

Two limits apply. The advisory states that no generic configuration change covers every path, since an application, extension or server path can still leave stale state behind. These settings also do nothing for the first PHP2Shell flaw, CVE-2026-109618, which has its own interim settings in PHP's announcement. Treat them as cover for a day or two while the real update is booked.

PHP added a related note to the same news page on 23 October. It covers CVE-2026-115560, another session upload progress issue, and this one needs an unusual setup. The application must set session.serialize_handler to php_binary or php_serialize, switch it to php with ini_set() before session_start(), and still have upload progress enabled. PHP calls this setup unlikely, will publish the full advisory with its next release, and recommends the same session.upload_progress.enabled=0 setting until then. Anyone who applied it on 21 October has nothing more to do.

PHP 8.1 and older get no official fix

PHP 8.1 and every older version no longer receive updates from the PHP project, so no official release fixes PHP2Shell on those branches. Some Linux distributions and long-term support vendors ship patched packages, such as php8.1 8.1.2-1ubuntu2.28 on Ubuntu 22.04 LTS. Everyone else has to move to a supported branch.

PHP 8.2 has a deadline of its own. It reaches end of life on 31 December 2026, 69 days after 23 October, and gets no security fixes after that date. If 8.2.35 is where you land this week, book the move to 8.3 or 8.4 before the year ends rather than waiting for the next emergency to force it.

Is PHP2Shell being exploited? Status on 23 October 2026

Yes, attackers are trying it. When we checked on 23 October 2026, watchTowr reported exploitation of both PHP2Shell flaws in the wild. Amazon's MadPot honeypots had already recorded an attempt on 17 October, four days before the fix went public. Neither flaw was in CISA's Known Exploited Vulnerabilities catalog.

The Hacker News reported that the flaws reach back as far as PHP 5.4. It also reported that a research firm posted a video of a working proof of concept by mistake on 20 October. SOCRadar later found exploit tooling on an attacker's server aimed at Apache mod_php sites that show PHP errors and keep session upload progress on. Sansec's 22 October update says mass exploitation looks less likely than first feared, because the public exploits need specific server conditions and fail against a default PHP install. Public reports have not confirmed a successful break-in so far. That is no reason to wait a week.

How Techno Mantraa fixes PHP2Shell within 12 hours

Give our team hosting or server access, and the vulnerability is resolved on your website within 12 hours. The work follows the order of this guide and ends with a written record, so you know what changed on your server.

1. Check the PHP version and how PHP is installed: hosting panel build, distribution package, source build or Windows.
2. Apply the fixed PHP release or your vendor's patched package.
3. Add the interim hardening where it is needed, such as switching off session upload progress at server level.
4. Restart PHP-FPM, Apache and every long-running PHP worker.
5. Test the site: main pages, logins, forms and checkout.
6. Review the logs for signs of attack.
7. Send you a short report of what changed.

Nobody can promise that a site will never be hacked, and this fix makes no such claim. It closes these two holes, looks for signs that someone used them, and tells you what the logs showed. To book it, send your site details through our contact page and mention how your site is hosted.

Need help moving off old PHP?

If your site runs PHP 8.1 or older, it cannot get the PHP2Shell fix. We upgrade it to a patched PHP 8.4 in 7 days: PHP 5.6, PHP 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 to PHP 8.4. On PHP 8.2 or 8.3, patch now and plan the PHP 8.2 or PHP 8.3 to 8.4 upgrade.

Rather leave old PHP code behind? See our PHP to Laravel, PHP to Node.js and PHP to Python migrations, or move an online store with PHP to Shopify.