cPanel, Plesk and shared hosting

PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). On shared hosting, your host installs and runs PHP for you. Here is where to see your PHP version, and what to ask your host.

Last reviewed 22 October 2026. Rules of 22 October 2026.

What to know first

• The fix is a PHP update. Updating WordPress, plugins or other apps leaves PHP as it is.
• The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• Hosts and vendors can put the fix into older PHP builds and keep the old version number, so an old number alone does not show that the fix is missing.
• Only your host can confirm which build you run. The message below asks for you.

See your PHP version in cPanel

1. Log in to cPanel.
2. In the Software section, open MultiPHP Manager.
3. The list shows the PHP branch or package that each domain uses, such as PHP 8.3 (ea-php83). It does not show the patch level.

The label Inherited means the domain uses the server's default PHP version. Only the server administrator can change that default.

Hosts can hide MultiPHP Manager. If yours is missing, ask your host for the PHP version of each domain.

The PHP Version menu switches a domain between PHP versions that are already on the server. It does not install the fix.

The fix in EasyApache 4

cPanel's own PHP comes from EasyApache 4, in packages named ea-php74 to ea-php85. cPanel released EasyApache 4 version 25.91 on 21 October 2026. It fixes both CVEs in those packages only.

• Many shared hosts on cPanel also run CloudLinux alt-php packages (PHP Selector). EasyApache 4 25.91 does not update them. They need their own fix from the vendor.
• EasyApache 4 25.91 changes nothing for ea-php73 and older. Those packages have no fix from cPanel.
• So first find out which PHP package serves each domain: ea-phpXX, alt-phpXX or something else.

PHP 8.1 and older are end of life, and the PHP project ships no new releases for them. When your apps allow it, move to a supported branch. See Fixed versions.

Plesk

A Plesk server can have several PHP versions installed at once, and Plesk sets up several handler types for each, such as CGI, FastCGI and PHP-FPM. The Plesk guide covers updates and restarts in full.

See your PHP version

1. Log in to Plesk and go to Websites & Domains.
2. Find the domain. The PHP version shows next to the PHP icon on the domain card.
3. Click PHP to see the PHP version and the handler type.

For server administrators

• Tools & Settings › PHP Settings lists the PHP handlers on the server.
• Our advice: install the PHP updates for every PHP version on the server, then check the version of every handler. A site that uses a handler you did not update keeps the old PHP.
• Plesk can add handlers for outdated PHP versions from TuxCare (packages whose names start with alt-php). These update through the Plesk System Updates tool. TuxCare ELS is a paid extension with its own licence. Ask TuxCare or your host whether your alt-php build contains the CVE-2026-109618 and CVE-2026-109619 fix.

LiteSpeed hosting

Some hosts use the LiteSpeed web server, which runs PHP through its own interface, LSAPI.

• php.net names LiteSpeed in its list of setups at risk.
• The PHP security advisories say exploits against LSAPI are likely but depend on the application. No exploit has been shown yet.
• For CVE-2026-109619, LSAPI can apply some PHP settings early. The advisory calls it a conditional candidate for one of the attack paths.

On LiteSpeed the fix is the same: the host has to update PHP.

What to ask your host

Copy this message, add your domains, and send it to your host’s support:

Hello,

Please confirm that the PHP on my hosting includes the fixes for
PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

Domains: example.com

1. Which PHP package serves each domain (ea-phpXX, alt-phpXX
   or other), and which exact version and build?
2. Is it 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or a build
   with the fix backported? For ea-php74 to ea-php85: is
   EasyApache 4 25.91 or later installed? For alt-php or
   ea-php73 and older: which vendor fix is installed?
3. Were PHP-FPM, the web server and other PHP workers restarted
   after the update?

Thank you.

If your host cannot confirm the fix, ask when they will install it.

After the update

• MultiPHP Manager shows only the branch, so it cannot confirm the fix. Read the exact version in a phpinfo page, or ask your host. For PHP 7.4, 8.0 and 8.1, ask for the package release that has the backport. Delete the phpinfo file right after you read it.
• Every PHP process has to restart to load the new PHP. On shared hosting the host does this; ask if you are not sure.
• php2shell.com says memory disclosure can expose passwords, API keys and other secrets, even without code execution. If your site ran an affected PHP, change the passwords and keys your site stores.

Technical notes

• php.net says every PHP install that serves web requests is at risk. It names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php as the highest risk, because a shown exploit runs before any application code.
• Switching to PHP-FPM does not fix it. Remote code execution through PHP-FPM was confirmed for CVE-2026-109619, given a suitable application operation.
• The php -v command over SSH can show a different PHP from the one your website uses. Use a phpinfo page or your host for the exact version. MultiPHP Manager shows only the branch. Delete the phpinfo file right after you read it: the Nextcloud manual also treats exposed phpinfo data as a security risk.
• No configuration setting fully replaces the update. Mitigations has interim steps.

Sources

• php.net security advisory, 21 October 2026
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• php2shell.com research
• cPanel: EasyApache 4 change log 25
• cPanel: MultiPHP Manager for cPanel
• Plesk: PHP settings
• Plesk: Installing PHP
• Plesk: Outdated PHP versions

Check your site

The checker reads the public response of your site and reports any PHP version it can see. Check my site.