aaPanel PHP: how to update for PHP2Shell

Is aaPanel affected by PHP2Shell?

Yes, unless every PHP version on the server has been updated. aaPanel installs PHP from its App Store (PHP 5.2 to 8.5 are listed in aaPanel’s App Store docs), and a site is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619) while its PHP is older than the fixed release for its branch. Nginx, Apache and OpenLiteSpeed sites are all in scope, because the flaws are in PHP. The upstream fixed releases are:

How do I check the PHP version in aaPanel?

aaPanel shows each site’s PHP version in the site list. According to aaPanel’s PHP Project docs, open Website → PHP Project: the PHP column displays the PHP version of each site, and clicking it lets you change that version.

The same page has a separate PHP CLI setting, which only sets the PHP version used on the command line. That’s why php -v over SSH can show a different version from the one your website runs. For the version the site actually serves, use the phpinfo view in that PHP’s settings or, for WordPress, Tools → Site Health → Info → Server (WordPress: Site Health).

Did aaPanel ship fixed PHP?

Yes, aaPanel announced it. On 21 October 2026 (15:10 UTC), aaPanel staff posted Critical PHP Security Update on the official aaPanel forum. It says patches are available for PHP 7.4 to 8.5 only, and asks users to update to:

These are the same numbers that 宝塔 published for its Chinese edition. The PHP project itself released no new versions below 8.2, only source patches for 7.4, 8.0 and 8.1 (PHP advisory). Because 8.0.27 already existed in 2023, the number alone can’t tell you whether you have the patched build; rely on the App Store showing no pending update.

Forum users reported that the updates appeared in the App Store on 21 October, and that some updates failed to build on their servers. We couldn’t confirm that every build is available on every operating system as of 22 Oct 2026.

How do I update PHP in aaPanel?

Follow the steps from aaPanel’s announcement:

1. Take a server snapshot backup through your cloud provider.
2. Go to App Store and click Update App List (top-right) to refresh it.
3. Find your PHP version and click Update.
4. If several PHP versions are installed, update each one.

If an update fails, aaPanel’s App Store docs point to the install logs /tmp/panelExec.log and /tmp/panelShell.pl, and to the forum for help.

How do I restart PHP and verify the fix in aaPanel?

Restart each updated PHP from its settings in the App Store. aaPanel’s Deployment docs describe App Store → Deployment → PHP, where Service manages the PHP service status. aaPanel’s announcement also says to restart PHP manually after changing its configuration.

Then check the PHP column in Website → PHP Project and what the site reports (phpinfo or Site Health). Every site should show a fixed version from the table above.

What if I can’t update aaPanel’s PHP yet?

If the update isn’t available or fails to build, apply PHP’s temporary settings and restart PHP. aaPanel’s announcement repeats PHP’s guidance, such as session.upload_progress.enabled=0 in php.ini or the FPM pool rather than .user.ini. In aaPanel, the php.ini is under that PHP’s Configuration file setting. These settings are not a fix; see the PHP2Shell workaround page. aaPanel’s WAF, or any other WAF, isn’t a fix either, because PHP itself stays vulnerable.

What about old PHP 7.x on aaPanel?

aaPanel has no PHP2Shell patch for PHP 7.3 and older; its announcement points those users to PHP’s mitigations. aaPanel says its 7.4.34 build includes the PHP2Shell patch, but PHP 7.4 is end-of-life, so plan a move to 8.2 or newer: see PHP end of life.

After updating, use the PHP2Shell checker to read your version, follow the PHP2Shell patch guide, and check whether your site was hacked.