PHP2Shell patch: fixed PHP versions and how to update

Which PHP versions contain the PHP2Shell patch?

These are the first fixed releases; any newer release in the same branch also has the patch. Linux distributions backport the patch into their own packages, often keeping an older-looking version number. The table below also lists images, panels and hosts whose status we haven’t verified yet:

PHP 8.1 and older get no new releases. PHP published minimal source patches for 7.4, 8.0 and 8.1, and some distributions ship fixed packages for these branches; see PHP end of life.

Which PHP2Shell patch guide matches my setup?

How do I get the PHP2Shell patch on shared hosting?

On shared hosting the host installs PHP. Some update automatically; others offer several PHP versions per site, and you only get the fix after choosing a patched one.

1. Check your version. In WordPress: Tools → Site Health → Info → Server. Otherwise, your hosting panel’s PHP settings.
2. Compare it with the fixed releases above, or use the PHP version checker.
3. Switch to a fixed version in the same branch if your panel offers one.
4. Otherwise ask your host, using the message below.
5. Confirm the new version once they reply.

Some hosts temporarily suspended their control panels or service sites as a precaution, for example XServer and Lolipop in Japan. If your panel is unavailable, check the host’s status page or announcements before changing anything.

What should I send my hosting provider?

Copy this into a support ticket and replace the bracketed parts:

Hello, my website [example.com] is hosted with you. PHP has released security fixes for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Could you tell me:

1. Which PHP version my site runs?
2. Whether it has been updated to a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer) or a vendor package that includes the fix?
3. Whether all PHP workers were restarted afterwards?
4. If not yet, when the update will be applied, and whether I need to do anything?

Thank you.

If your host says the site is patched but the version number didn’t change, ask which package or security notice contains the fix; distribution backports can keep the old number.

Will updating PHP break my site?

Moving to a newer release in the same branch (for example from an older 8.3 release to 8.3.36) brings bug and security fixes, not new features, so it rarely breaks sites. Changing branch, for example from 7.4 to 8.3, can break older themes, plugins or code: make a backup and test on a staging copy first. After updating, check login, forms, uploads, payments and scheduled tasks, not just the homepage.

How do I confirm the PHP2Shell patch worked?

• Restart every PHP process. PHP-FPM pools and Apache keep running the old PHP until they restart.
• Check what the website reports, not only the command line: WordPress Site Health or your control panel. php -v on the server shows the command-line PHP, which can differ. Enter the result in the PHP version checker.
• Repeat for every site, worker pool and container. One fixed site doesn’t mean the others are.
• If you patched late, review the check if your website is hacked guide. The patch closes the hole but doesn’t remove a backdoor.

What if I can’t install the PHP2Shell patch today?

Use the official stopgaps only to buy time: they reduce exposure to specific attack paths but are not a fix and don’t make the site safe. See the PHP2Shell workaround page. If you can’t patch, several national agencies have advised taking the site offline or isolating it until you can.

How do I explain the patch to my manager or clients?

Report facts: which sites run which PHP, what has been updated, what’s still pending, who owns it and when the next update is due. Keep “patched” separate from “checked for intrusion”. Example: “Our sites run PHP. Two critical PHP vulnerabilities were fixed today; we updated [N] sites, [M] are pending with our host, expected by [date].” Back to the PHP2Shell checker.

Which sources support this page?

• The PHP Group: security advisory and fixed releases
• GitHub advisory GHSA-w8hw-w9fx-j79w
• GitHub advisory GHSA-6wmf-4rv5-p3rp
• WordPress.org: Update PHP
• WordPress.org: Site Health screen
• Canonical: Ubuntu security notice
• Debian: security announcement
• cPanel: MultiPHP Manager
• Plesk: PHP settings
• XServer: precautionary control panel suspension (X)
• Lolipop: precautionary suspension notice (X)