How to Patch PHP2Shell on cPanel, Plesk, DirectAdmin and CloudLinux, and Confirm It Worked Official steps to patch PHP2Shell on cPanel, Plesk, DirectAdmin and CloudLinux, how to confirm the fix worked, and what WordPress owners should ask their host.
How to Patch PHP2Shell on cPanel, Plesk, DirectAdmin and CloudLinux, and Confirm It Worked
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 at 14:00 UTC to fix the pair of flaws known as PHP2Shell (a summary of the flaws is here ). Sites on the panels covered here get PHP from the panel vendor's packages or build system, so the fixed version number doesn't always match php.net's, and cPanel and Plesk also run a separate PHP for the panel itself that needs its own update.
This guide is for web agencies, SMEs that run their own servers, and hosting customers. It is a snapshot of the vendors' official pages as of October 25, 2026; for fixed builds, rollout status and required action, each vendor's current advisory or status page is the source of truth.
Short answer: update through the channel your panel vendor names, restart PHP the way your handler requires, then confirm the way that vendor says to. On shared or managed hosting you can't patch PHP yourself, so ask your provider the questions in the WordPress section below.
Before you start: know which PHP branch each site uses
Most panels set PHP per domain, so every installed branch needs the update. To find which PHP each site really runs, see how to check the PHP version each site really runs .
Summary table: where the fix comes from and how to confirm it
Panel Fix comes from Fixed package or version (as of Oct 25) How to confirm cPanel/WHM EasyApache 4 release 25.91 ea-php82 8.2.35, ea-php83 8.3.36, ea-php84 8.4.27, ea-php85 8.5.12; backport for ea-php74/80/81 (same number) Package version for every branch, or CVE IDs in the changelog cPanel on CloudLinux CloudLinux's ea-php builds ea-php52 to ea-php85, e.g. ea-php84 8.4.26-2.elX.cloudlinux.1 or 8.4.27-1 CVE IDs in the changelog cPanel's own PHP cPanel update cpanel-php84 8.4.27 in 134.0.66, 136.0.50, 138.0.18 /usr/local/cpanel/cpanel -VPlesk Plesk Installer Linux: 8.2.35, 8.3.36, 8.4.27, 8.5.12, plus 7.4.33/8.0.30/8.1.34 built Oct 21, 2026; Windows: 8.2.35, 8.3.36, 8.4.27, 8.5.12 PHP Settings, or the build date Plesk's own PHP Plesk update Obsidian 18.0.81 Update 4 or 18.0.80 Update 11 plesk versionDirectAdmin CustomBuild (staff posts) 8.2.35, 8.3.36, 8.4.27, 8.5.12; patches for 8.1 down to 5.6 (same number) * after the version, or the patch fileCloudLinux alt-php CloudLinux repositories alt-php 5.2 to 8.5, including alt-php82 8.2.35-1 to alt-php85 8.5.12-1 CVE IDs in the changelog, or the package version WP Engine, Kinsta, Pantheon The host patches Per the host's notice Host status page and Site Health aaPanel, HestiaCP Not confirmed Unknown Follow the vendor's documentation
If you'll be working through this table across dozens of servers every round, see pricing for zcr's per-host package tracking before you decide.
cPanel/WHM: EasyApache 4 and ea-php
EasyApache 4 release 25.91 (Oct 21) moved ea-php82 through ea-php85 to fixed versions and backported the fix to ea-php74, ea-php80 and ea-php81, which keep their version numbers (EA4 change log ).
Update: in WHM, open EasyApache 4 and click Run system update . That opens System Update, which updates every package on the server, not only PHP; if you tick Include kernel packages, the server may need a reboot. Click Proceed (cPanel: System Update ). The same job from the command line is /usr/local/cpanel/scripts/rpmup2 (Upgrade to Latest Version ).Restart by handler:
Confirm: rpm -q ea-php84-php-cli is one example, for the 8.4 CLI package (expect 8.4.27, or a later build per the vendor's current advisory; on Ubuntu, dpkg -l ea-php84-php-cli). Repeat it for every installed branch, and confirm each site's active web runtime separately. For ea-php74/80/81, check the changelogs of ea-php74-meta, ea-php80-meta and ea-php81-meta, as the EA4 change log names them; release 25.92 rebuilt them so they record the backport.ea-php73 and older: the EA4 change log lists no fix. Move those domains to a fixed branch, or use TuxCare ELS, which cPanel's MultiPHP Manager docs point to for PHP 5.6 and 7.x (ask the vendor to confirm the build fixes both CVEs). More in still on legacy PHP .
cPanel on CloudLinux uses ea-php builds from CloudLinux. On Oct 21 they shipped as backports with numbers below php.net's, such as ea-php84 8.4.26-2.elX.cloudlinux.1; on Oct 23 builds with php.net's numbers followed, such as ea-php84 8.4.27-1. CloudLinux says the first builds already fix both CVEs and the new ones only align the numbers. After updating, restart as in step 2, then check every installed branch (ea-php84 is the example).
# CloudLinux OS 8, 9, 10 (OS 7: yum clean all && yum update "ea-php*")
dnf clean all && dnf upgrade "ea-php*"
# confirm (read-only)
rpm -q --changelog ea-php84-php-cli | grep -E 'CVE-2026-(109618|109619)'
cPanel's own PHP: cpanel-php84 moved to 8.4.27 in builds 134.0.66, 136.0.50 and 138.0.18 (136 change log ). Check with /usr/local/cpanel/cpanel -V; if yours is older, update through WHM » Home » cPanel » Upgrade to Latest Version or /scripts/upcp (within your release tier). The 132 change log we read (latest build 132.0.35, May 20) lists no such fix, so servers on 132 or older need a major-version upgrade or confirmation from cPanel. Watch for servers pinned to a numbered build in /etc/cpupdate.conf: cPanel's hourly security-update cron takes no action on them (Update Preferences ).
Plesk
Plesk's advisory gives one action: "Update Plesk to the latest available version."
Update: Tools & Settings > Updates > Update Components > Continue, or run plesk installer update over SSH (on Windows, from an Administrator command prompt). Services whose components are updated get restarted (How to install Plesk updates ).Confirm PHP: Tools & Settings > PHP Settings shows versions in the handler names, or run each branch's binary, e.g. /opt/plesk/php/8.3/bin/php -v, which prints the version and build date. For 7.4.33, 8.0.30 and 8.1.34 the number doesn't change: the build must be dated October 21, 2026 or later. This is the CLI binary, so still confirm from the web side.Confirm Plesk itself: sw-engine (Linux) and plesk-engine (Windows) are fixed in Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 or later; check with plesk version.Plesk for Windows has fixes for 8.2.35, 8.3.36, 8.4.27 and 8.5.12 only.PHP 5.6, 7.2 and 7.3: Plesk recommends paid TuxCare ELS. Ask the vendor to confirm your platform is supported and that both CVEs are fixed.
DirectAdmin: CustomBuild
This section comes from staff posts (user fln, tagged Staff member) in the "Critical PHP updates" thread on DirectAdmin's official forum . In the sources we reviewed as of Oct 25 we found no separate DirectAdmin advisory page.
Update and rebuild: run da update, then da build php. Staff say DirectAdmin updates itself, but the PHP build must be triggered manually unless the CustomBuild cron feature is on.What you get: the first build (Oct 21, 13:54 UTC) moved 8.2 to 8.5 to 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and patched 8.1, 8.0 and 7.4. A later build added patches for 7.3, 7.2, 7.1, 7.0 and 5.6 and fixed an 8.1 compile problem, and the rhel7 and debian10 legacy channels followed.Confirm: a version shown with * means the same PHP version with new patches. For 7.4, if custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch exists and CustomBuild shows no pending 7.4 update, you're current. Staff confirmed one patch file covers both CVEs.Restart: the staff posts don't give a step, and we found no official procedure in the sources we reviewed. Follow DirectAdmin's documentation and confirm from the web side.
CloudLinux: alt-php
alt-php is the PHP that customers pick in PHP Selector. Fixed alt-php 5.2 to 8.5 reached stable for CloudLinux OS 7, 8 and 9 on Oct 22 at 00:07 UTC; CloudLinux OS 10 gets them from the ELS ALT PHP repository.
# CloudLinux OS 8, 9, 10 (OS 7: yum clean all && yum update "alt-php*")
dnf clean all && dnf upgrade "alt-php*"
# confirm (read-only), repeat for every installed branch
rpm -q --changelog alt-php74-common | grep -E "CVE-2026-(109618|109619)"
rpm -q alt-php85-common
Use a regular update. OVAL and UpdateInfo metadata weren't published, so security-only updates such as yum --security don't list these packages.Keep the php-els repository enabled. CloudLinux corrected itself on Oct 23: it is becoming the single source of alt-php.Nothing to install? Check rpm -q cloudlinux-release against 7.9-2.17, 8.10-16, 9.8-3 or 10-5; if yours is older, update it first, then retry.Restart: CloudLinux's status page says to restart Apache, PHP-FPM or LiteSpeed but gives no per-service command; use your web server's documentation.The OS's own PHP 8.2 and 8.3, rebased to 8.2.35 or 8.3.36, carry no CVE IDs in the changelog; check rpm -q php-cli instead.
CloudLinux reported that Imunify360 rulesets 8.83 to 8.85 target the upload-progress path and that, as of Oct 21 at 23:00 UTC, no rule covered CVE-2026-109618's out-of-memory path. It calls this "an interim mitigation, not a fix" (see how far a WAF gets you ).
WordPress on managed hosting: what site owners should do
WordPress.org said on October 21 that these flaws are not specific to WordPress: no WordPress update is required or planned. Site owners should check with their host that PHP is updated; the version is under Tools > Site Health > Info > Server.
What the large managed WordPress hosts said at the time (their own statements):
WP Engine (Oct 22): customers didn't need to take any action; all customer sites ran fully patched PHP.Kinsta (resolved Oct 22, 08:26 UTC): PHP 7.4 to 8.5 patched across the platform, with no evidence of breaches.Pantheon (resolved Oct 22): no customer action required; live sites on 8.2 to 8.5 and LTS versions were patched on Oct 21; on Oct 21 it said free/sandbox environments would follow within 24 to 48 hours.
If your host hasn't said anything, ask in writing:
Which PHP branch does my site run, and does the installed package fix both CVE-2026-109618 and CVE-2026-109619? Please give the package name and build, because a backported build can show a lower number than php.net's in Site Health even when patched.
Were the PHP workers restarted after the update?
Is the panel itself (cPanel, Plesk) updated?
If my site is on 8.1 or older, where does the fix come from, and when can I move to 8.2 or later? (8.2 reaches end of life on December 31, 2026.)
Are staging, dev and sandbox environments included?
"We turned on WAF rules" on its own doesn't count as patched.
Gaps we couldn't confirm (as of October 25, 2026)
aaPanel: its forum announcement wouldn't load when we checked, so we have no confirmed steps. Check aaPanel's own notice.HestiaCP: the newest release page we read (1.10.5, September 14) predates PHP2Shell, and we found no official statement. Follow HestiaCP's own channels.
Out of scope here: servers without a panel (updating PHP on your own server ), appliances with PHP inside (products that bundle PHP ), and whether a host was already compromised (hunting in your logs ).
Before you close this round
For each server, write down the panel, its PHP branches, the installed package builds, when you patched and restarted, and whether you confirmed from the web side; you'll need the same list next time. For Linux servers you run, zcrX uses Agents to keep matching each host's packages to CVE advisories and CISA KEV status. It doesn't replace the update or the checks above.
📞 Free Consultation
zcr supplies the software; hands-on patching and server checks are delivered through partners.
Related articles
More in the PHP2Shell series:
Sources
PHP News Archive 2026 — fixed versions, PHP 8.1 and older, 8.2 end of life on Dec 31, 2026cPanel — EasyApache 4 Change Log 25 — releases 25.91 and 25.92cPanel — 132 Change Log , 134 Change Log , 136 Change Log and 138 Change Log — cpanel-php84 8.4.27cPanel — EasyApache 4 Interface , System Update , Upgrade to Latest Version and Update Preferences cPanel — The restartsrv Script and MultiPHP Manager for WHM CloudLinux Status — Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 — ea-php, alt-php, update and confirm commands, Imunify360Plesk — Vulnerability CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) and How to install Plesk updates DirectAdmin Forums — Critical PHP updates — staff posts onlyWordPress.org — Critical PHP Security Release WP Engine — Two critical CVEs affecting PHP , Kinsta Status and Pantheon Status HestiaCP release 1.10.5 Products | Pricing | Resources | Insights | Contact 