PHP2Shell Patch: How to Update PHP

The PHP2Shell patch is a PHP update, not a plugin or app update. Install PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or a vendor package with the fix, on every runtime, then restart.

Find the PHP version that serves your site

The version the web server uses matters, not just the command-line one. The most reliable way is a temporary phpinfo file in the web root:

echo '<?php echo PHP_VERSION, " ", PHP_SAPI;' > v-$(openssl rand -hex 6).php

Open it in a browser, note the version and SAPI, then delete it right away with rm v-*.php. You can also run php -v and systemctl list-units --type=service 'php*' to list PHP services.

Ubuntu and Debian PHP2Shell patch

dpkg -l 'php*' 'libapache2-mod-php*' | grep ^ii
zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php8.3-common/changelog.Debian.gz
sudo apt update && sudo apt install --only-upgrade "php8.3*"
sudo systemctl restart php8.3-fpm apache2

Replace 8.3 with your branch. If you use the ondrej/php PPA or sury.org repository, the update brings the upstream fixed version. If the changelog search returns nothing, the fix is not installed yet.

RHEL, AlmaLinux, Rocky and CentOS Stream

rpm -qa | grep -Ei "^(php|ea-php|alt-php)" | sort
rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"
sudo dnf upgrade "php*" && sudo systemctl restart php-fpm httpd

Red Hat backports fixes without changing the upstream version, so the changelog is the evidence. Red Hat rates the CVEs Important and notes that RHEL runs PHP through PHP-FPM rather than mod_php; check its CVE page for the RHSA. The Remi repository had no update on release day, so Remi users should check rpms.remirepo.net before assuming they are patched. Fixed package versions for Ubuntu and Debian are on the distro packages page.

cPanel / WHM and CloudLinux

cPanel installs each PHP version side by side. Open WHM → Software → MultiPHP Manager to see which versions sites use, then check each one:

for p in /opt/cpanel/ea-php*/root/usr/bin/php; do $p -v | head -1; done
for p in /opt/alt/php*/usr/bin/php; do $p -v | head -1; done
sudo dnf upgrade "ea-php*" "alt-php*"

Plesk

plesk bin php_handler --list
/opt/plesk/php/8.3/bin/php -v
plesk installer --select-release-current --upgrade-installed-components

Or use Tools & Settings → Updates in the Plesk panel.

aaPanel / BT Panel

for p in /www/server/php/*/bin/php; do echo "$p: $($p -r 'echo PHP_VERSION;')"; done

Then App Store → PHP-x.y → Settings → Update, or reinstall the latest minor version. Each installed version is updated separately.

Docker and Kubernetes

docker ps --format '{{.Names}}\t{{.Image}}'
docker exec <container> php -v
# after the image publisher ships a fixed tag (for example php:8.3.36-fpm):
docker compose build --pull && docker compose up -d

A running container never updates itself. Rebuild every image that contains PHP, including images built on wordpress, drupal or nextcloud base images, once those publish fixed tags.

Shared hosting and WordPress hosts

You usually cannot patch PHP yourself. Switch the site to a fixed version in the hosting panel. If the panel only shows "8.3" with no patch number, ask support whether their build includes the fixes for CVE-2026-109618 and CVE-2026-109619. More in PHP2Shell and WordPress.

After the PHP2Shell patch

• Run the PHP2Shell checker again, or re-check the phpinfo version.
• Undo temporary measures such as memory_limit = -1 and follow the final PHP recommendations.
• Keep post_max_size below your memory budget and consider expose_php = 0. This hides the version but is not a fix.

PHP2Shell patch FAQ