LiteSpeed PHP (lsphp) and PHP2Shell: update and restart lsphp

Is LiteSpeed PHP (lsphp) affected by PHP2Shell?

Yes. lsphp is PHP built with the LiteSpeed SAPI, so it carries PHP2Shell (CVE-2026-109618 and CVE-2026-109619) like any PHP below the fixed releases. PHP’s advisory includes LiteSpeed among the web deployments to update, and the SAPI name doesn’t show whether a build is patched. This applies to LiteSpeed Web Server (LSWS) and OpenLiteSpeed alike. The fixed releases are:

How do I check which lsphp version my site uses?

Check the package and the web runtime, not just the shell. Each lsphp version installs to its own folder, such as /usr/local/lsws/lsphp83/bin/lsphp per LiteSpeed’s PHP docs, and the external application or script handler decides which one a site uses. Ask the package manager for the installed version (for example rpm -q lsphp83 or dpkg -l | grep lsphp). From the web side, WordPress Site Health or a temporary php_sapi_name() page reports the version, and the SAPI shows as litespeed. A php command on your PATH may be a different PHP. See the check PHP version guide.

Has LiteSpeed shipped fixed lsphp packages?

Yes for 8.2 to 8.5, though without an announcement. LiteSpeed’s package repository published these builds on 21 October 2026:

Sources: the EL 9 package listing (EL 8 matches) and the Debian/Ubuntu repository, where every distribution’s index was refreshed on 21 October; we checked package versions for noble only. LiteSpeed’s blog, release log and lsphp changelog had no PHP2Shell notice as of 22 Oct 2026. For 8.1 and older we found no fixed release: the newest lsphp81 RPM is 8.1.34-1 from December 2025, and we couldn’t confirm what Ubuntu’s 8.1.34-21+noble build changed.

How do I update lsphp?

1. If you haven’t already, add LiteSpeed’s repository as its docs show: sudo wget -O - https://repo.litespeed.sh | sudo bash.
2. On RHEL-family systems, upgrade the lsphp packages, for example sudo dnf upgrade 'lsphp*'.
3. On Debian or Ubuntu, refresh the index with sudo apt-get update and reinstall the lsphp packages you use, as in LiteSpeed’s install example (sudo apt-get install lsphp83 lsphp83-common lsphp83-mysql), which pulls the newest version.
4. Confirm the installed version against the table.

If LiteSpeed sits on a control panel such as cPanel, the site may use the panel’s PHP instead, managed in cPanel’s MultiPHP Manager; see change PHP version in cPanel.

How do I restart lsphp and verify the fix?

Updating packages doesn’t stop running lsphp processes. LiteSpeed’s how-to page and the OpenLiteSpeed PHP guide use the same two commands:

sudo touch /usr/local/lsws/admin/tmp/.lsphp_restart.txt
sudo systemctl restart lsws

In the WebAdmin Console, use Actions → “Restart Detached PHP Processes” and then “Apply Changes / Graceful Restart”. Afterwards, reload Site Health or your test page and confirm the new version, then enter it in the PHP version checker.

What if I can’t update lsphp yet?

Apply PHP’s stopgaps, such as turning off session.upload_progress.enabled and lowering post_max_size in the php.ini that lsphp loads, then run the restart steps above. They block specific paths only; see the CVE-2026-109618 workaround.

What about lsphp74, lsphp80 or lsphp81?

PHP releases no fixed 7.4, 8.0 or 8.1 versions, only source patches, and we found no fixed lsphp builds for them. Move sites to lsphp82 or later. See PHP end of life, the PHP2Shell patch guide and the PHP2Shell checker.