PHP2Shell.help
English
Menu
Fixed releases available for PHP 8.2–8.5 Independent community resource · facts verified 22 Oct 2026

PHP2Shell checker / hestiacp php version

HestiaCP PHP version: fixing PHP2Shell for sites and the panel

HestiaCP has two PHP layers. Sites use PHP-FPM packages from the Sury repository, which the Hestia team says are patched for PHP2Shell; upgrade them now and restart PHP-FPM. The panel runs on its own hestia-php, which Hestia says is affected and was being rebuilt. Until that ships, the team suggests stopping the panel.

PHP2Shell.help editorsVerified Official sources ↓

Is HestiaCP affected by PHP2Shell?

Yes, in two places. Hosted sites run on PHP-FPM packages from the Sury repository, and the panel itself runs on Hestia’s own bundled PHP, hestia-php. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is in PHP itself, so both layers need the fix, and Nginx sites are not exempt. A Hestia staff member said on the forum that the issue is with PHP “regardless of whether you use Nginx or Apache”. The upstream fixed releases are:

BranchFirst fixed release
PHP 8.28.2.35
PHP 8.38.3.36
PHP 8.48.4.27
PHP 8.58.5.12
8.1 and olderNo new release; official source patches for 7.4, 8.0 and 8.1

How do I check the PHP version in HestiaCP?

HestiaCP sets each site’s PHP version through its backend template. According to Hestia’s web domain docs, edit the web domain and select the PHP version in the Backend Template field; your administrator can disable this option. On the command line, v-list-web-domain USER DOMAIN lists a domain’s parameters (Hestia CLI reference).

The template shows which branch a site uses, not whether the installed build is patched. Confirm with what the site reports: phpinfo, or in WordPress Tools → Site Health → Info → Server (WordPress: Site Health).

Did HestiaCP ship fixed PHP?

Partly. On the official Hestia forum, the team posted Heads Up! Upcoming Critical PHP Security Release on 21 October 2026 and answered users in PHP vulnerability:

  • Site PHP: Hestia installs and updates PHP from the Sury repositories. A Hestia team member said that all PHP versions there, from 5.6 to 8.5, have been patched. When we read the Sury repository index for Debian 12 on 22 Oct 2026, it listed 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and builds dated 21 October 2026 for 5.6 to 8.1.
  • Panel PHP: the team said hestia-php is affected and that new packages were being built. Hestia’s GitHub repository has a commit “Bump hestia-php version to 8.5.12” dated 21 October 2026. When we checked the Hestia apt repository on 22 Oct 2026, its index was still dated 14 September 2026 and listed hestia-php 8.5.9, so we couldn’t confirm that a patched hestia-php had shipped.

How do I update PHP in HestiaCP?

Update the site PHP first, then the panel’s PHP:

  1. Upgrade the system’s PHP packages now. Hestia’s team told users to “upgrade your OS now” because fixed PHP versions are available.
  2. If apt fails against the old Launchpad PPA, move to packages.sury.org. Hestia’s team recommended it when the PPA servers were overloaded, and Hestia’s OS upgrade guide shows the Sury repository setup and says Ubuntu 26.04 gets PHP only from the Sury APT repository.
  3. Stop the panel until hestia-php is patched: systemctl stop hestia, as Hestia’s team suggested. Websites keep running after you update the PHP packages.
  4. Install the patched hestia-php when it’s published. Hestia pushes its own hestia-* packages through apt, and v-update-sys-hestia hestia-php runs the update for that package (Hestia CLI reference). Then start the panel again.

How do I restart PHP and verify the fix in HestiaCP?

Restart each PHP-FPM service you upgraded. Hestia’s v-restart-service SERVICE command restarts a system service (Hestia CLI reference); on Sury packages the service is named after the version, such as php8.3-fpm. Restart the panel with systemctl restart hestia after changing its PHP settings (Hestia configuration docs).

Then check that each site reports a fixed version, and that the panel’s hestia-php package shows the patched release once Hestia publishes it.

What if I can’t update HestiaCP’s PHP yet?

If you can’t update yet, apply PHP’s temporary settings and restart PHP: see the PHP2Shell workaround page. For the panel, Hestia’s team suggested setting memory_limit=-1, post_max_size = 8M and session.upload_progress.enabled=0 in /usr/local/hestia/php/lib/php.ini, or simply stopping the panel. These settings reduce exposure but don’t fix PHP2Shell. A WAF isn’t a fix either, because PHP on the server stays vulnerable.

What about old PHP 7.x on HestiaCP?

Hestia’s team says Sury has patched PHP 5.6 to 8.1 as well, so a normal package upgrade covers sites on old branches. Those branches are still end-of-life upstream, though, and the PHP project itself only published source patches for 7.4, 8.0 and 8.1. Plan a move to 8.2 or newer: see PHP end of life.

After updating, use the PHP2Shell checker to read your version, follow the PHP2Shell patch guide, and check whether your site was hacked.

Does stopping the Hestia service take my websites offline?

No. Hestia's team said that after you update the PHP packages, you can stop the panel with systemctl stop hestia and the websites keep running. Only the control panel becomes unavailable until you start it again.

Is updating my sites' PHP enough on HestiaCP?

Not completely. The panel runs on a separate hestia-php build, which Hestia's team said is also affected. Update the site PHP packages now, then install the patched hestia-php as soon as Hestia publishes it.

Check your PHP for PHP2Shell

Enter the version your website reports. We compare it with the first fixed release for its branch and tell you what to do next.

PHP2Shell checker →

Sources

The core facts on this page (fixed versions, CVE details, vendor packages and agency warnings) come from official sources. Research, news and community posts are labelled as such.