Is my Cloudways site affected by PHP2Shell?
A Cloudways application is affected by PHP2Shell if its server runs a PHP build older than the fixed release for its branch. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. It concerns PHP applications everywhere, WordPress, Laravel and custom code alike. On Cloudways, Cloudways manages the PHP packages on your server, so it rolls out the fix and you confirm the result. The fixed releases are:
| Branch | First fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
| 8.1 and older | No new release; official source patches for 7.4, 8.0 and 8.1 |
The PHP2Shell checker explains how to read your version.
Has Cloudways patched PHP for PHP2Shell?
Cloudways says patches are being rolled out in phases across its fleet, with interim mitigations already deployed. Its incident was still open, so we couldn’t confirm completion as of 22 Oct 2026. Cloudways’ status page incident Critical PHP Remote Code Execution Vulnerabilities - Monitoring & Mitigations Underway says:
- 21 October 2026, 09:16 UTC: Cloudways Security was applying interim mitigations, which might cause a short service disruption, ahead of PHP’s release. For deprecated PHP versions, Cloudways would use its Extended Long Term Support (ELTS) partners. Customers would get updates by email.
- 16:43 UTC: Further interim configuration-level mitigations recommended by PHP were being applied while Cloudways prepared a phased rollout of the official patches.
- 22:19 UTC: The interim mitigations were deployed across the fleet. Patches were rolling out for all Cloudways-supported PHP versions, including deprecated ones: PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3 and 8.4. The maintenance does not affect the availability of the platform or customer websites.
PHP 8.5 is not in that list. Configuration mitigations lower exposure, but PHP states that only an update is a complete solution.
How do I check my PHP version on Cloudways?
You check the PHP version on the Cloudways Platform, at server level. Cloudways’ own blog post PHP Version History (updated May 2026) gives the path:
- Log in to the Cloudways Platform.
- Select your server to open Server Management.
- Go to Settings & Packages → Packages and find the PHP version.
Cloudways also documents per-application PHP selection, in public preview, in its help article How to Change the PHP Version for a Specific Application on Cloudways. We couldn’t load that article’s steps as of 22 Oct 2026, so follow it directly. For the exact build an application runs, check what it reports; in WordPress, Tools → Site Health → Info → Server. The PHP version checker explains the number.
How do I switch to a fixed PHP version on Cloudways?
On Cloudways you don’t compile or install the fixed build; Cloudways patches the packages. You choose the branch. According to Cloudways’ blog post: in Settings & Packages → Packages, click Edit next to the current PHP version, choose a version from the drop-down and click Save.
The server-level setting applies to every application on that server unless you use per-application selection. Check compatibility, back up and, where possible, test on a staging application before changing branch.
What about WordPress sites on Cloudways?
WordPress sites on Cloudways get the PHP2Shell fix only through PHP. Updating WordPress, themes or plugins doesn’t fix it. After the rollout, open Tools → Site Health → Info → Server on each site and compare the PHP version with the table above. See PHP2Shell and WordPress.
What should I ask Cloudways support?
Contact Cloudways support if an application still reports a version below the fixed release after Cloudways reports the rollout complete. Ask:
- Which exact PHP build your server or application runs.
- Whether it includes the fix for CVE-2026-109618 and CVE-2026-109619.
- Whether PHP-FPM was restarted after the update.
- If you use PHP 8.5, when it will be patched.
A ready-made message is on the PHP2Shell patch page. Contact support from inside the Cloudways Platform, not via links in unexpected emails.
What if my Cloudways server runs old PHP?
Cloudways says it is patching deprecated versions back to 5.6 with its ELTS partners. PHP itself publishes no new releases for 8.1 and older, only minimal source patches for 7.4, 8.0 and 8.1. A patched 7.4 build may show the same version number as an unpatched one, so ask Cloudways how to confirm it. Plan a move to a supported branch anyway: see PHP end of life.
Do I need to do anything on Cloudways for PHP2Shell?
Cloudways' status updates describe it patching PHP across its fleet; they don't ask customers to act. Once Cloudways says the rollout is complete, check the PHP version each application reports and contact support if one is below the fixed release.
Will the Cloudways patch rollout take my site offline?
Cloudways said its earlier interim mitigations might cause a short service disruption. Its latest update said the patch maintenance does not affect the availability of the platform or customer websites.
Check your PHP for PHP2Shell
Enter the version your website reports. We compare it with the first fixed release for its branch and tell you what to do next.
PHP2Shell checker →Sources
The core facts on this page (fixed versions, CVE details, vendor packages and agency warnings) come from official sources. Research, news and community posts are labelled as such.
- Security advisory: Critical remote code execution vulnerabilities, update nowOfficial The PHP Group
- RCE via OOM corruptionOfficial The PHP Group
- RCE via stale global stateOfficial The PHP Group
- Site Health screenOfficial WordPress.org
- Critical PHP Remote Code Execution Vulnerabilities - Monitoring & Mitigations UnderwayVendor Cloudways
- PHP Version History: Brief Timeline of the World's Most Used Backend LanguageVendor Cloudways (blog)
- How to Change the PHP Version for a Specific Application on CloudwaysVendor Cloudways