DirectAdmin PHP version: install the PHP2Shell patch with CustomBuild

Is DirectAdmin affected by PHP2Shell?

Yes, until PHP is rebuilt with the fix. DirectAdmin’s CustomBuild compiles most packages, PHP included, from source (DirectAdmin: CustomBuild overview), and PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is in PHP itself. That holds for every handler DirectAdmin offers: PHP-FPM, FastCGI and LSPHP. The upstream fixed releases are:

How do I check the PHP version in DirectAdmin?

DirectAdmin users see and choose a domain’s PHP version on the Domain Setup page, through the PHP version selector (DirectAdmin: Multiple PHP versions). Subdomains can override it under Sub-Domains Setup.

Admins can list the installed versions with da build versions, or in the GUI under admin level CustomBuild > Updates (DirectAdmin: Upgrading services). For the version a site really runs, check phpinfo or, in WordPress, Tools → Site Health → Info → Server (WordPress: Site Health).

Did DirectAdmin ship fixed PHP?

Yes. DirectAdmin’s administrator posted the releases in the official forum thread Critical PHP updates on 21 October 2026:

• About 13:54 UTC: a new DirectAdmin build on the current and stable release channels bumps PHP 8.5, 8.4, 8.3 and 8.2 to the latest version (8.5.12, 8.4.27, 8.3.36, 8.2.35) and adds patches for PHP 8.1, 8.0 and 7.4.
• About 17:31 UTC: a further build adds patches for PHP 7.3, 7.2, 7.1, 7.0 and 5.6, and fixes PHP 8.1 not building cleanly on some systems.
• About 22:10 UTC: the same patching is pushed to the legacy rhel7 and debian10 release channels.

DirectAdmin staff said one patch file covers both CVEs. The patches for 5.6 to 7.3 are DirectAdmin’s own; the PHP project published source patches only for 7.4, 8.0 and 8.1 (PHP advisory). The DirectAdmin changelog didn’t yet list these PHP changes as of 22 Oct 2026.

How do I update PHP in DirectAdmin?

DirectAdmin’s administrator gave these commands to upgrade immediately:

1. Update DirectAdmin: da update
2. Rebuild PHP: da build php

DirectAdmin updates itself automatically, but the PHP rebuild must be triggered manually unless the CustomBuild cron update feature is enabled. You can also update from admin level CustomBuild > Updates, or update all CustomBuild components with da build update_versions (DirectAdmin: Upgrading services). Building from source takes a while for each PHP version, so plan a maintenance window and take a backup first.

How do I restart PHP and verify the fix in DirectAdmin?

Restart PHP-FPM for each version after the build. DirectAdmin’s PHP-FPM documentation uses systemctl restart php-fpm83 for PHP 8.3; use the matching service for each version.

Then verify:

• da build versions or CustomBuild > Updates shows no pending PHP update. For 7.4, 8.0 and 8.1 the number stays the same; a version marked with * means new patches were added to the same release. DirectAdmin staff said that the file custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch shows that PHP 7.4 has the patch.
• Each site reports a fixed version or a patched build (phpinfo or Site Health).

What if I can’t update DirectAdmin’s PHP yet?

If you can’t rebuild yet, apply PHP’s temporary settings at server or PHP-FPM pool level, not in .user.ini, and restart PHP-FPM: see the PHP2Shell workaround page. These settings reduce exposure but don’t fix PHP2Shell. A WAF in front of the server isn’t a fix either, because PHP itself stays vulnerable.

What about old PHP 7.x on DirectAdmin?

DirectAdmin has released patches for PHP 5.6 to 8.1, but those branches are end-of-life and the patches don’t restore normal support. Move sites to PHP 8.2 or newer when you can: see PHP end of life.

After updating, use the PHP2Shell checker to read your version, follow the PHP2Shell patch guide, and check whether your site was hacked.