PHP2Shell.fyi Check a site

aaPanel

PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). aaPanel installs its own PHP builds under /www/server/php, one per version, and each site picks one. Update the panel's PHP, then restart it.

Last reviewed . Rules of .

What to know first

See the PHP of a site

The list shows the branch, such as 8.3. For the exact build, open App Store › Deployment, open that PHP version and use View phpinfo().

See every PHP on the server

# one folder per installed version, such as 82 and 83
    ls /www/server/php

aaPanel does not install its PHP with apt, yum or dnf. Our reading: your Linux updates do not update these builds. Update them in aaPanel.

The php command uses the PHP CLI version set in the website settings, which can differ from the version a site uses. aaPanel says to set it again after you install a new PHP version.

Update PHP

  1. Open the App Store and find your PHP version.
  2. If it shows Update, click it.
  3. Check the version again with View phpinfo(). You need 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later in the same branch.

If aaPanel does not offer the fixed release yet, ask aaPanel when it comes.

PHP 8.1 and older: php.net has no fixed release for these. Install a supported version in the App Store, check that your app runs on it, and switch the site in the PHP column.

Restart PHP

Restart the PHP service in the App Store, or on the command line. Use your version without the dot, such as 83:

/etc/init.d/php-fpm-83 restart
    /etc/init.d/php-fpm-83 status

A running PHP process keeps the old code in memory until it stops. Restart Apache, every PHP-FPM pool and any long-running PHP workers, such as queue workers (php2shell.com). In a container, rebuild the image and recreate the container (our advice).

Check your site

The php2shell.fyi checker reads the PHP version your site shows in public. A header is a hint, not proof. A distribution build often reports an old number, so confirm the package version on the server. A result never proves that a site is not exposed.

Sources