CyberPanel PHP version: updating LSPHP for PHP2Shell

Is CyberPanel affected by PHP2Shell?

Yes, until its LSPHP builds are updated. CyberPanel serves sites through LiteSpeed’s PHP (LSPHP), and PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is in PHP itself; PHP’s advisory includes web-facing LiteSpeed installations. CyberPanel also runs its own panel and phpMyAdmin on a separate PHP executable, which needs the fix too. The upstream fixed releases are:

How do I check the PHP version in CyberPanel?

CyberPanel shows each website’s PHP version in the website list. According to CyberPanel’s guide How to Use Website Home in CyberPanel, select Websites in the left sidebar and open the website list; expanding a row shows the PHP version, and the Manage page header shows it too. To change it, use Websites → Modify Website, select the domain and choose the PHP version (CyberPanel: Modify Website).

On the server, each LSPHP branch lives under /usr/local/lsws/lsphpXX/ (for example lsphp83 for PHP 8.3). A command-line check doesn’t prove what websites run, so confirm with a real web request: phpinfo, or in WordPress Tools → Site Health → Info → Server (WordPress: Site Health).

Did CyberPanel ship fixed PHP?

Yes, through LiteSpeed’s packages. CyberPanel’s post Critical PHP security updates: CyberPanel response and testing plan was published on 21 October 2026 and updated on 22 October 2026. Its “Verified update” of 21 October says:

• Fixed LiteSpeed packages are available. On CyberPanel’s Ubuntu 26.04 QA server, PHP was updated to 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• The fix is the PHP package update plus a refresh of the panel’s PHP copy. It doesn’t require or claim a new CyberPanel release.
• PHP 8.1 and older need a vendor-confirmed backport or a move to a supported fixed branch.

LiteSpeed’s own package repository lists lsphp82 8.2.35, lsphp83 8.3.36, lsphp84 8.4.27 and lsphp85 8.5.12 dated 21 October 2026, for example in the EL9 index and the Ubuntu 24.04 pool. We found no PHP2Shell post on LiteSpeed’s blog as of 22 Oct 2026.

How do I update PHP in CyberPanel?

CyberPanel’s post lists these steps for administrators:

1. Take a provider snapshot or a verified backup.
2. List every installed and served PHP branch, including the panel’s own PHP.
3. Use the signed LiteSpeed repository for your operating system, with package signature checks on.
4. Refresh repository metadata and confirm the candidates are 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Review a simulated upgrade first.
5. Upgrade each installed branch together with its matching modules, including OPcache. CyberPanel notes that updating PHP core while keeping an old OPcache module is incomplete.
6. Refresh the panel’s PHP copy. On CyberPanel’s server, which used PHP 8.3 for the panel, /usr/local/lscp/fcgi-bin/lsphp was replaced with the updated /usr/local/lsws/lsphp83/bin/lsphp, keeping root ownership and checking that both SHA256 hashes match. Don’t copy the 8.3 path blindly if your panel uses another branch.

How do I restart PHP and verify the fix in CyberPanel?

Restart the web and panel services during a maintenance window and make sure the old LSPHP workers have exited. CyberPanel warns that detached workers can outlive a web-server restart. OpenLiteSpeed’s detached mode documentation restarts all detached PHP processes with touch /usr/local/lsws/admin/tmp/.lsphp_restart.txt (they restart on the next request), or stops them at once with killall -9 lsphp.

Then verify, as CyberPanel did: the PHP version in a real HTTP request for every branch you serve, the panel login, phpMyAdmin, and your applications. A CyberPanel version number, a successful package command or a CLI version alone is not enough.

What if I can’t update CyberPanel’s PHP yet?

If a fixed package isn’t available for your system yet, apply PHP’s temporary settings, as CyberPanel’s post describes: set session.upload_progress.enabled=0 in the global php.ini or server configuration of each web-facing PHP (not via ini_set() or .user.ini), add fatal_error_backtraces=0 on PHP 8.5, and restart every worker. CyberPanel edits php.ini per version under Server > PHP > Edit PHP Configs (CyberPanel: PHP Configurations). These settings are partial and don’t fix the out-of-memory flaw; see the PHP2Shell workaround page. ModSecurity or any other WAF isn’t a fix either.

What about old PHP 7.x on CyberPanel?

CyberPanel says PHP 8.1 and older need evidence of a maintained backport or a migration plan. LiteSpeed’s repository shows new package revisions of lsphp74, lsphp80 and lsphp81 dated 21 October 2026, but we couldn’t confirm that they include the PHP2Shell patch. Move these sites to 8.2 or newer: see PHP end of life. The panel’s own PHP is covered on the phpMyAdmin page.

After updating, use the PHP2Shell checker to read your version, follow the PHP2Shell patch guide, and check whether your site was hacked.