For whoever runs the server
How to update PHP on any server or host
For PHP2Shell, updating means moving to the fixed patch release on your branch (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or to your vendor's fixed package, then restarting PHP so no old process keeps serving requests. The steps depend on what runs your server.
Last reviewed against php.net and the cPanel, Plesk, Microsoft, Docker and Red Hat documentation.
Run a WordPress site on a hosting plan? You will usually change PHP from your host's control panel rather than on the server itself. Follow how to update PHP in WordPress instead.
Find your route
Where your PHP comes from decides how you update it
Each route below has its own step-by-step guide. Whichever you follow, finish with the checks that prove the update took effect.
On a hosting plan or control panel
Shared or managed hosting
Your host patches PHP; you find the version, ask the right questions and choose the branch.
WordPress
Switch the PHP version behind a WordPress site from the host's panel, after testing plugins.
cPanel and WHM
MultiPHP Manager per domain, EasyApache 4 and the ea-php packages for administrators.
Plesk
Per-domain PHP settings, PHP handlers and Plesk's own PHP components.
On a server you run
Ubuntu
Ubuntu's security notices, apt and the backported version strings Ubuntu ships.
Debian
Debian security and LTS updates, the security tracker and packages.sury.org.
RHEL, AlmaLinux and Rocky
dnf, AppStream module streams, the Remi repository and Red Hat's bulletin.
Windows and IIS
php.net's Windows builds, including the 26 October 2026 packages, under IIS FastCGI.
Docker
Rebuild on a fixed image tag and replace every running container.
On any Linux distribution, the fixed package can carry an older-looking version number. Updating PHP on Linux, and reading backported versions explains how to tell.
The versions to aim for
You do not need to change branch to fix PHP2Shell if you are on 8.2 or later; the patch release on your branch is enough.
| Branch | Update to |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later (branch supported until 31 December 2026) |
| PHP 8.1 and older | No fix from the PHP project: move to a supported branch, or to a vendor package that carries the fix |
Source: the PHP project's 21 October 2026 security releases. The full advisory detail is on the PHP2Shell page.
Server API
How PHP runs on your server
The way PHP connects to the web server decides what you restart after an update, and with PHP2Shell it also changes the risk. php.net lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as affected, so every one of them needs the update.
Not sure which you have? WordPress Site Health shows it as
PHP SAPI, and PHP's
php_sapi_name() function returns the
same value: fpm-fcgi for PHP-FPM,
apache2handler for mod_php and
litespeed for LiteSpeed.
After the update
Confirm the update took effect
A new package on disk does not protect a site that is still served by old processes. Work through these three checks on every server.
1. Restart PHP, not just the web server
Red Hat's bulletin for these flaws says a reload is not sufficient; restart the service so every PHP worker starts again on the new build.
| Setup | Restart with | Notes |
|---|---|---|
| PHP-FPM on Debian or Ubuntu | sudo systemctl restart php8.4-fpm | The service is named after the branch: php8.4-fpm on Debian 13, php8.3-fpm on Ubuntu 24.04. Restart each branch you run. |
| PHP-FPM on RHEL, AlmaLinux or Rocky | sudo systemctl restart php-fpm | PHP-FPM is the default way RHEL 8 and later run PHP. |
| Apache with mod_php | sudo systemctl restart apache2 | On the RHEL family the service is httpd: sudo systemctl restart httpd. |
| LiteSpeed Web Server | sudo touch /usr/local/lsws/admin/tmp/.lsphp_restart.txt | Detached PHP processes restart the next time each handler is used. To stop them all at once: sudo killall lsphp. |
| Windows and IIS | iisreset /restart | Run from an elevated prompt. This drops every session on the server, so choose your moment. |
| Docker and Kubernetes | docker compose up -d | Replace the running container or pod with one built from the fixed image. |
2. Check what the live site reports
Read the version through the website itself: Site Health, the
control panel or a temporary version file that you delete
afterwards. php -v only tells you
about the command-line build. On a distribution package, compare
the package version with the distribution's advisory rather than
the upstream number.
3. Check every copy, not only the main site
- Every server behind a load balancer, not only the one you logged in to.
- Staging, test and old marketing sites that are still reachable.
- Container images in your registry, not only the containers running today.
- Appliances and packaged products with PHP inside: the NCSC asks organisations to watch for their vendors' updates.
Both vulnerabilities are on CISA's Known Exploited Vulnerabilities catalogue. If a server was reachable from the internet before you patched it, the update does not undo anything an attacker did in the meantime. Has your PHP site been compromised?
Quick answers
Updating PHP: questions, answered
Do I have to move to a newer PHP branch to fix PHP2Shell?
Not if you are on PHP 8.2, 8.3, 8.4 or 8.5. Each of those branches has a fixed patch release (8.2.35, 8.3.36, 8.4.27 and 8.5.12), so updating within your branch is enough. PHP 8.1 and older get no fix from the PHP project, so those servers need a newer branch or a vendor package that carries the fix. PHP 8.2 itself reaches end of life on 31 December 2026.
I run a WordPress site on a hosting plan. Is this page for me?
Probably not. On a hosting plan you change the PHP version from your host's control panel, and the host patches the PHP builds themselves. The WordPress guide covers that route, including testing plugins before you switch branch.
Is restarting the web server enough after an update?
Only when PHP runs inside it, as with Apache and mod_php. With PHP-FPM you must restart the PHP-FPM service, and LiteSpeed's detached PHP processes survive a web server restart. Red Hat's bulletin for these flaws is explicit that a reload is not enough: restart the service.
How do I know which way PHP runs on my server?
WordPress Site Health shows it as PHP SAPI under Tools > Site Health > Info > Server, and the PHP function php_sapi_name() returns the same value. fpm-fcgi means PHP-FPM, apache2handler means Apache with mod_php, and litespeed means LiteSpeed's LSAPI.
Does PHP2Shell affect XAMPP?
XAMPP bundles PHP for local development, and Apache Friends, which publishes it, says it is not meant for production use. A copy that only runs on your own computer is not the internet-facing risk this page is about. If a XAMPP install is reachable from the internet, treat that as the first thing to fix.
My server has been updated. Do I still need to check for compromise?
Yes, if it was reachable from the internet while it ran a vulnerable build. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on 26 October 2026. Updating closes the hole but removes nothing an attacker may already have left on the server.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.