Change PHP version in cPanel (and Plesk) for the PHP2Shell fix

How do I change the PHP version in cPanel?

1. Log in to cPanel and open MultiPHP Manager (usually in the Software section).
2. Tick the domain you want to change.
3. Choose the PHP version from the list and click Apply.
4. Reload the site and confirm the new version (for WordPress: Tools → Site Health → Info → Server).

If MultiPHP Manager isn’t available, your host manages PHP centrally; ask support using the message in the PHP2Shell patch guide.

How do I change the PHP version in Plesk?

1. Go to Websites & Domains and select the domain.
2. Open PHP (PHP settings).
3. Pick the PHP version and handler, then save.
4. Reload the site and check the version it reports.

Which PHP version should I pick for PHP2Shell?

The fixed release for your current branch, or newer in the same branch, is the safest switch:

Staying in the same branch avoids compatibility problems. Jumping to a new branch (for example from 7.4) needs a backup and testing first; see PHP end of life.

Why can’t I select a fixed PHP version?

The menu lists only builds your host has installed. If you see the branch but can’t tell whether it’s patched, or there’s no fixed build, the host needs to install the update. Ask for the exact build and whether it includes the fix for CVE-2026-109618 and CVE-2026-109619. Hosts that use Linux distribution packages may ship the fix under an older-looking number, so ask which security notice applies.

Does choosing a version in the panel prove I’m patched?

No. The panel shows which version is selected, not whether that build contains the fix or whether PHP workers restarted. Confirm with what the website reports, and with your host for backported builds. The PHP version checker helps you read the result.

What should I check after switching?

Check every domain and subdomain separately, because each can use a different PHP version. Then test logins, forms, uploads and payments. If something breaks after a branch change, involve your developer rather than switching back to an unpatched version.

Can I turn off session.upload_progress in cPanel’s MultiPHP INI Editor?

Be careful. PHP says the session.upload_progress.enabled=0 stopgap only works when it applies before PHP parses the request, and that ini_set() and PHP-FPM .user.ini files are not enough. Settings you edit per site in a control panel may be written to exactly such a per-directory file. Ask your host to apply it at server or pool level and restart PHP, and treat it as a temporary stopgap, not a fix: see the PHP2Shell workaround page.

Do I need to change anything in WordPress after switching PHP?

Not for PHP2Shell itself. The fix is in PHP. Do check Site Health afterwards for warnings about PHP extensions or compatibility, and update plugins that report problems with the new version. The WordPress PHP version guide covers the WordPress side.

My control panel is unavailable. What now?

Some hosts temporarily suspended their control panels as a precaution; XServer in Japan, for example, said its suspension was not caused by unauthorised access. Check your host’s status page or announcements, don’t change DNS or move the site in a hurry, and contact support. Overview: PHP2Shell checker.

Which sources support this page?

• cPanel: MultiPHP Manager
• Plesk: PHP settings
• The PHP Group: security advisory
• WordPress.org: Site Health screen
• XServer: precautionary control panel suspension (X)