Guide How to Fix PHP2Shell (CVE-2026-109618/109619) in aaPanel

Guide How to Fix PHP2Shell (CVE-2026-109618/109619) in aaPanel - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: aaPanel (https://adminsforum.com/Forum-aapanel)
+---- Forum: aaPanel Guides & Tutorials (https://adminsforum.com/Forum-aapanel-guides-tutorials)
+----- Forum: aaPanel Security Guides (https://adminsforum.com/Forum-aapanel-security-guides)
+----- Thread: Guide How to Fix PHP2Shell (CVE-2026-109618/109619) in aaPanel (/Thread-guide-how-to-fix-php2shell-cve-2026-109618-109619-in-aapanel)

How to Fix PHP2Shell (CVE-2026-109618/109619) in aaPanel - JAY - 10-22-2026

How to Fix PHP2Shell (CVE-2026-109618/109619) in aaPanel

On 21 October 2026 PHP released emergency fixes for two critical bugs, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). They can let an attacker run code on your server without logging in, and attacks are already happening. This guide shows how to patch a server running aaPanel, step by step.

New to PHP2Shell? Read the overview first: PHP2Shell explained: what it is and how to fix it.

The fixed versions
Your PHP must be at least: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older branches (7.4 to 8.1) need a patched build from your vendor. Update every PHP version installed, not just the one your main site uses.

Step 1: See which PHP versions you have
In aaPanel, open App Store and click Installed. Note every PHP version listed (for example PHP-8.3 and PHP-8.5). Or check from the terminal:

Code:

for d in /www/server/php/*/; do echo "$d $($d/bin/php -r 'echo PHP_VERSION;')"; done

Step 2: Update each PHP version
aaPanel has released patched PHP builds. Before you start, take a snapshot of the server at your provider: the update restarts PHP, so sites go down for a few seconds.

Open App Store.
Click Update App List (top right) so aaPanel sees the new builds.
Find your PHP version and click Update.
Repeat for every PHP version installed.

aaPanel also published patched builds for older 7.x versions. Those are aaPanel's own patches, so test them before using them in production. Better: move sites to PHP 8.2 or newer.

Step 3: Don't forget OpenLiteSpeed (lsphp)
If you ever installed OpenLiteSpeed in aaPanel, it has its own separate PHP ("lsphp") that the App Store update doesn't touch. This is easy to miss: aaPanel's own PHP can show as patched while lsphp is still on an old version. Check:

Code:

ls -d /usr/local/lsws/lsphp* 2>/dev/null
/usr/local/lsws/lsphp83/bin/php -v | head -1

Update it from the terminal:

Code:

# Ubuntu / Debian
apt-get update && apt-get install --only-upgrade 'lsphp*' -y

# AlmaLinux / Rocky / CentOS
yum update 'lsphp*' -y

Then restart the lsphp workers so they load the new version:

Code:

pkill lsphp

OpenLiteSpeed starts fresh workers automatically on the next request.

Step 4: Confirm the new versions
Run the version check from Step 1 again. Every PHP should show 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer). Also check that PHP really restarted:

Code:

ps -eo lstart,cmd | grep "php-fpm: master" | grep -v grep

The start time should be after your update.

Check the version your websites really use
The command line can show a different PHP from the one serving websites. To be sure, create a file called

Code:

v.php

in a website's folder containing:

Code:

<?php echo PHP_VERSION;

Open

Code:

https://your-domain/v.php

, check the number, then delete the file.

Can't update yet? Temporary protection
These settings reduce the risk until a patched version is installed. They are not a full fix. Add them to the php.ini of each PHP version (App Store > PHP-8.x > Setting > Configuration file), then restart PHP:

Code:

session.upload_progress.enabled = 0
; PHP 8.5 only:
fatal_error_backtraces = 0

Don't set these with

Code:

ini_set()

or a

Code:

.user.ini

file; they must be set server-side. The PHP team also suggests

Code:

memory_limit = -1

against CVE-2026-109618, but that removes PHP's memory cap, so only use it short-term and with care.

After patching: check you weren't hit
Attacks started on 17 October, before the fix existed. Spend ten minutes on these checks:

PHP files created or changed since 17 October that you don't recognise, especially in upload folders:

Code:
find /www/wwwroot -name "*.php" -newermt 2026-10-17 -type f 2>/dev/null | head -50
Unknown cron jobs:
Code:
crontab -l
for root and each site user.
Unusual CPU use (crypto miners are common):
Code:
ps aux --sort=-%cpu | head

If something looks wrong, change the passwords and API keys your PHP apps use, because these bugs can leak memory contents.

Questions? Ask in aaPanel Security Support with your OS, aaPanel version and the output of your PHP version check.

Sources (checked 22 October 2026): aaPanel: Critical PHP security update · Tenable PHP2Shell FAQ · Qualys: mitigate and patch PHP2Shell