1Panel PHP: move your sites to a fixed PHP runtime for PHP2Shell

Are 1Panel sites affected by PHP2Shell?

Most likely, yes, until you change the runtime. 1Panel’s PHP runtimes are PHP-FPM containers, and the PHP project says FPM deployments are affected too; putting OpenResty in front doesn’t change that. Any site whose PHP is below the fixed release for its branch is in scope:

PHP2Shell is a flaw in the PHP runtime. In 1Panel, what needs fixing is the PHP inside each runtime container and each one-click app, not the panel program.

How do I find which PHP a 1Panel site uses?

It depends on how the site was created:

1Panel’s website configuration docs say a PHP site can switch between PHP runtimes, and the PHP runtime docs describe creating runtimes from the App Store or locally. Also note whether you run 1Panel v1 or v2, because their PHP app packages are maintained separately. Some cloud images ship v1; Alibaba Cloud’s Simple Application Server image, for example, is documented as 1Panel 1.10.x.

Has 1Panel released a PHP2Shell fix?

The images and App Store have been updated, but we found no 1Panel announcement as of our check (nothing in the docs, forum or GitHub releases). Here’s what we verified:

• The 1panel/php tags on Docker Hub list all seven -fpm tags, pushed on October 21, 2026 (UTC) for amd64, arm64 and arm/v7.
• v2 App Store: appstore PR #10065 was merged at 22:11 UTC on October 21. It makes 8.5.12 the PHP 8 default and 7.4.34 the PHP 7 default, and labels the 7.4, 8.0 and 8.1 fixes “1Panel patched”.
• v1 App Store: appstore PR #10068 was merged at 01:05 UTC on October 22. Its description warns that v1 image builds and runtime compatibility hadn’t all been verified when it was written.
• The runtime repository notes explain the maintenance tags: the PHP project’s source patches applied to the last official release, with the PHP version number left unchanged.

How do I update PHP in 1Panel?

1Panel v2 runtime sites, using the documented menus:

1. Back up site files and databases.
2. Go to Websites → Runtime → PHP and click Create Runtime Environment. Choose the App Store source and a fixed version (for 7.4, 8.0 or 8.1, the entry labeled “1Panel patched”), and select the same extensions as the old runtime. If no fixed version appears, your panel’s App Store data hasn’t synced yet; don’t fall back to an old version.
3. Copy any php.ini changes from the old runtime (More → Configuration) to the new one.
4. In the site list, open Configuration → Basic → PHP and switch the site to the new runtime.
5. Once the site works, stop the old runtime.

The v2.3.0 release notes add support for changing the version of an installed runtime, so you can also change the existing runtime’s version. We didn’t verify every button; follow your panel’s screens.

1Panel v1: the fixed v1 packages were added on October 22 with a compatibility caveat. Create a test runtime on a fixed version, try it with a test site (extensions, uploads), then switch production sites. 1Panel also documents upgrading from v1; take full backups first.

One-click apps: upgrade them from App Store → Installed, on the upgrade list (installed apps docs). The app image decides its PHP, so check PHP afterwards; see the Docker PHP image page.

Local runtimes: update the host’s PHP packages; see the PHP2Shell patch guide and Update PHP on Ubuntu.

How do I restart and verify?

Once a site uses the new runtime, its requests go to the new PHP-FPM container. If you changed an existing runtime’s version, wait until it has rebuilt and shows as running. Then:

1. Confirm the site’s Configuration → PHP shows the new runtime.
2. For 7.4, 8.0 and 8.1, don’t rely on php -v: the maintenance tags keep 7.4.33, 8.0.30 and 8.1.34 as the version string. Check that the runtime uses 7.4.34, 8.0.31 or 8.1.35. For 8.2–8.5, the fixed number should appear directly.
3. Repeat for every runtime and every PHP-based one-click app.

WordPress sites can also check Site Health. Enter your result in the PHP version checker, and use the PHP2Shell checker for your other environments.

What if I can’t update yet?

Apply the stopgaps while you schedule the update. Edit php.ini under the runtime’s More → Configuration as described in the PHP2Shell workaround, save, and restart the runtime so every PHP-FPM worker reloads. These settings block only some attack paths. A cloud WAF or firewall can reduce exposure, but it isn’t a fix. For sites handling user data or payments, consider taking them offline or restricting access until they’re updated.

Don’t download “patches” or scripts posted in issue comments or chat groups. Use 1Panel’s own images and the PHP project’s releases.

What about older PHP versions in 1Panel?

1Panel’s PHP 7 list still offers 7.0–7.3 without any fix, and the PHP project only published source patches for 7.4, 8.0 and 8.1. Move 5.6 and 7.0–7.3 sites to 8.2 or later, and restrict access to any you can’t move yet. Switching 7.4, 8.0 or 8.1 to the 1Panel maintenance tags fixes these two flaws only; those branches are no longer supported. See PHP end of life.