Update PHP on Windows and IIS for the PHP2Shell fix

Is PHP on Windows affected by PHP2Shell?

Yes. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a flaw in PHP itself, so any Windows server or PC running PHP below the fixed release for its branch is affected, whichever web server it uses. On IIS, PHP runs through FastCGI (php-cgi.exe), a web deployment that PHP’s security advisory tells admins to update. The fixed releases are:

How do I check which PHP version IIS uses?

Check the PHP that IIS actually calls, not just the command line. php -v in Command Prompt reports whichever php.exe comes first on your PATH, which may be a different copy from the php-cgi.exe in IIS. In IIS Manager, open Handler Mappings and look at the executable path for *.php; that folder is the PHP your site uses. From the web side, WordPress Site Health or a temporary php_sapi_name() page should report cgi-fcgi under IIS. Remove any test page afterwards. More methods are in the check PHP version guide.

Are fixed PHP builds for Windows available?

Yes. PHP published Windows builds of all four fixed releases on 21 October 2026, in the official Windows release folder. The old windows.php.net download page now redirects to php.net’s Windows downloads, which lists file sizes and SHA256 hashes. For IIS, the x64 Non Thread Safe files are:

Thread Safe and x86 variants are in the same folder. PHP’s page says the builds need the Visual C++ Redistributable for Visual Studio 2015-2022. There are no new Windows files for 7.4, 8.0 or 8.1: the newest are from 2024 and 2025, before PHP2Shell.

How do I update PHP on Windows with IIS?

1. Download the NTS x64 zip for the branch you already run, and compare its SHA256 with the value on php.net. Avoid zips from third-party mirrors or bundles.
2. Extract it to a new folder, then copy over your php.ini and check that any third-party extensions you load exist for the new build.
3. In IIS Manager, point the *.php handler mapping and the FastCGI setting at the new folder’s php-cgi.exe. PHP’s IIS install page describes this mapping and shows how to script it with APPCMD.
4. Install the Visual C++ Redistributable if it’s missing.

Staying on the same branch (8.3.x to 8.3.36, for example) avoids application compatibility surprises. Moving up a branch is a separate project.

How do I restart IIS and verify the fix?

Restart IIS so no old php-cgi.exe process keeps running: in IIS Manager select the server node and click Restart in the Actions pane, or run iisreset /restart in an elevated prompt, as Microsoft’s IIS guide) describes. Restarting drops active sessions, so pick a quiet moment. Then load Site Health or your test page again and confirm the new version, and enter it in the PHP version checker. If you run Apache on Windows instead, it uses the Thread Safe build; restart the Apache service after swapping it.

What if I can’t update PHP on Windows yet?

Use PHP’s stopgaps in php.ini, such as turning off session.upload_progress.enabled and lowering post_max_size, then restart IIS. They block specific attack paths only. See the CVE-2026-109618 workaround for the full list and limits.

I still run PHP 7.4, 8.0 or 8.1 on Windows. What now?

PHP’s backports for 7.4, 8.0 and 8.1 are source patches only, and PHP published no Windows binaries of them. On Windows, the realistic fix is moving to 8.2 or later. Read PHP end of life for options, and use the PHP2Shell patch guide and the PHP2Shell checker to confirm where you stand. Using XAMPP or another bundle? See XAMPP PHP version.