CloudPanel PHP version: getting the PHP2Shell fix

Is CloudPanel affected by PHP2Shell?

Yes, until its PHP packages are upgraded. CloudPanel runs sites on PHP-FPM and supports PHP 7.1 to 8.5 (CloudPanel: Technology Stack). PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is in PHP itself, and PHP’s advisory covers FPM deployments, so an Nginx + PHP-FPM site is not exempt. The upstream fixed releases are:

How do I check the PHP version in CloudPanel?

CloudPanel sets the PHP version per site. According to CloudPanel’s site Settings docs, open the site, go to its Settings, and in PHP Settings you can see and change the PHP Version, along with values such as memory_limit and post_max_size.

That page shows which branch a site uses, not whether the installed build is patched. Confirm with what the site reports: phpinfo, or in WordPress Tools → Site Health → Info → Server (WordPress: Site Health).

Did CloudPanel ship fixed PHP?

We found no PHP2Shell notice from CloudPanel as of 22 Oct 2026. The CloudPanel changelog ends at v2.5.4 (1 July 2026) and the CloudPanel blog has no post on it.

CloudPanel’s package repository does carry fixed builds. CloudPanel’s installer configures d17k9fuiwb52nc.cloudfront.net (amd64) or d2xpdm4jldf31f.cloudfront.net (arm64) as its apt source and pins it with priority 1000. When we read that repository’s package indexes on 22 Oct 2026, they listed the same versions for both architectures:

The Ubuntu 24.04 index for PHP 8.3 was last modified on 21 October 2026 at 18:17 UTC. Users in CloudPanel’s GitHub tracker reported that the builds arrived at different times per distribution during 21 October. The 7.4, 8.0 and 8.1 packages still carry the version numbers 7.4.33, 8.0.30 and 8.1.34, and we couldn’t confirm whether any of them include the PHP2Shell patch.

How do I update PHP in CloudPanel?

CloudPanel ships its software as Debian packages. Its update guide says:

1. Create an image or snapshot of the instance first.
2. Log in via SSH as root.
3. Run clp-update to update CloudPanel.

CloudPanel doesn’t document a separate procedure for PHP security updates, and its update guide doesn’t say whether clp-update upgrades the PHP packages. The PHP versions are ordinary packages from CloudPanel’s repository (its guides install PHP packages with apt), so refresh the package lists with apt update and upgrade every installed php8.x package with your normal apt workflow. Check the candidate version first: it should be a fixed release from the table above. Because the installer pins CloudPanel’s repository, adding a third-party PHP repository doesn’t replace these builds.

How do I restart PHP and verify the fix in CloudPanel?

Restart PHP-FPM for every branch you upgraded. CloudPanel’s own guide uses systemctl restart php8.4-fpm for PHP 8.4 (CloudPanel: ionCube Loader); use the matching service name for each version.

Then open each site and check the version it reports (phpinfo or Site Health). Check that the extensions your sites need still load after the upgrade.

What if I can’t update CloudPanel’s PHP yet?

If no fixed build is available for your system yet, apply PHP’s temporary settings at server or FPM pool level and restart PHP-FPM: see the PHP2Shell workaround page. Those settings reduce exposure but don’t fix PHP2Shell. Allowing only Cloudflare traffic, or any other WAF, isn’t a fix either, because PHP on the server stays vulnerable.

What about old PHP 7.x on CloudPanel?

CloudPanel still offers PHP 7.1 to 8.1, but we couldn’t confirm a PHP2Shell patch for any of them in CloudPanel’s repository. PHP itself publishes no new releases for 8.1 and older. Move those sites to 8.2 or newer in PHP Settings after testing: see PHP end of life.

After updating, use the PHP2Shell checker to read your version, follow the PHP2Shell patch guide, and check whether your site was hacked.