[JAY]

How to Fix PHP2Shell (CVE-2026-109618/109619) on CloudPanel

On 21 October 2026 PHP released emergency fixes for two critical bugs, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). They can let an attacker run code on your server without logging in, and attacks are already happening. This guide shows how to patch a server running CloudPanel, step by step.

New to PHP2Shell? Read the overview first: PHP2Shell explained: what it is and how to fix it.

The fixed versions
Your PHP must be at least: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older branches (7.4 to 8.1) need a patched build from your vendor. Update every PHP version installed, not just the one your main site uses.

Step 1: See which PHP versions you have
CloudPanel installs several PHP versions side by side as system packages. List them:

Code:Copy

ls /etc/php/ for v in /usr/bin/php[0-9]*; do echo "$v $($v -r 'echo PHP_VERSION;')"; done

Step 2: Update PHP with apt
Take a snapshot of the server at your provider first. Then, as root:

Code:Copy

apt update apt list --upgradable 2>/dev/null | grep -i php

If PHP packages are listed, install them:

Code:Copy

apt install --only-upgrade 'php*'

Or update everything at once with

Code:Copy

apt update && apt -y upgrade

, which we recommend anyway.

No PHP updates listed? The packages may not be published for your OS yet. Check again later today, and apply the temporary protection below in the meantime.

Step 3: Restart PHP-FPM
Restart every PHP version you updated, so the running workers load the fixed code:

Code:Copy

systemctl restart php8.1-fpm php8.2-fpm php8.3-fpm php8.4-fpm 2>/dev/null systemctl list-units --type=service | grep -i 'php.*fpm'

The second command shows the PHP services on your server; make sure each one restarted.

Step 4: Confirm
Check the installed package version for each PHP:

Code:Copy

dpkg -l | grep -E 'php8\.[0-9]+-fpm'

Distribution packages sometimes keep the old version number while including the fix, so also check the package changelog for the CVE:

Code:Copy

zcat /usr/share/doc/php8.3-fpm/changelog.Debian.gz 2>/dev/null | grep -m3 -E 'CVE-2026-10961[89]'

Check the version your websites really use
The command line can show a different PHP from the one serving websites. To be sure, create a file called

Code:Copy

v.php

in a website's folder containing:

Code:Copy

<?php echo PHP_VERSION;

Open

Code:Copy

https://your-domain/v.php

, check the number, then delete the file.

Can't update yet? Temporary protection
These settings reduce the risk until a patched version is installed. They are not a full fix. Add them to the php.ini of each PHP version (

Code:Copy

/etc/php/8.x/fpm/php.ini

), then restart PHP:

Code:Copy

session.upload_progress.enabled = 0 ; PHP 8.5 only: fatal_error_backtraces = 0

Don't set these with

Code:Copy

ini_set()

or a

Code:Copy

.user.ini

file; they must be set server-side. The PHP team also suggests

Code:Copy

memory_limit = -1

against CVE-2026-109618, but that removes PHP's memory cap, so only use it short-term and with care.

After patching: check you weren't hit
Attacks started on 17 October, before the fix existed. Spend ten minutes on these checks:

• PHP files created or changed since 17 October that you don't recognise, especially in upload folders:
  
  Code:Copy

  find /home/*/htdocs -name "*.php" -newermt 2026-10-17 -type f 2>/dev/null | head -50
• Unknown cron jobs:
  Code:Copy

  crontab -l
  for root and each site user.
  
• Unusual CPU use (crypto miners are common):
  Code:Copy

  ps aux --sort=-%cpu | head

If something looks wrong, change the passwords and API keys your PHP apps use, because these bugs can leak memory contents.

Questions? Ask in CloudPanel Security Support with your OS, CloudPanel version and the output of your PHP version check.

Sources (checked 22 October 2026): Tenable PHP2Shell FAQ · Qualys: mitigate and patch PHP2Shell