PHP2Shell.fyi Check a site

DirectAdmin

PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). DirectAdmin builds PHP with CustomBuild. A server can run several PHP versions, and each domain picks one. Update every version on the server, then restart PHP-FPM.

Last reviewed . Rules of .

What to know first

See the PHP of a domain

If the selector is missing, the administrator can check it with da config-get php_version_selector. The panel shows the branch. For the exact build, use the commands below or a short phpinfo() test.

See installed and available versions

For server administrators. In the panel: admin level CustomBuild › Updates. On the command line:

# installed and available versions of every component, PHP included
    da build versions

Check every PHP version that is installed. Each needs 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later in the same branch.

Update PHP

# update every component that has an update
    da build update_versions
    # or rebuild only PHP, then rewrite the web server configuration
    da build php
    da build rewrite_confs

CustomBuild has to offer the fixed release first. If da build versions does not show it as available, ask DirectAdmin support when it comes.

PHP 8.1 and older: php.net has no fixed release for these. Move each slot to a supported branch, after you check that your apps run on it. DirectAdmin's pattern, with your slot and version:

da build set php1_release 8.3
    da build php
    da build rewrite_confs

CustomBuild can also update on its own with da build set updates yes. DirectAdmin says the administrator still needs to watch the system's state.

If your server uses CloudLinux alt-php packages, CustomBuild does not build them. Ask CloudLinux or your host for their fix (our advice).

Restart PHP

# one service per PHP version (use yours)
    systemctl restart php-fpm83
    # list them all
    systemctl list-units 'php-fpm*'

A running PHP process keeps the old code in memory until it stops. Restart Apache, every PHP-FPM pool and any long-running PHP workers, such as queue workers (php2shell.com). In a container, rebuild the image and recreate the container (our advice).

php -v is not the domain's PHP

The php command runs one of the installed versions. A domain can use another one. Check every version in da build versions, or read the version in phpinfo for that domain. Delete the phpinfo file right after you read it.

Check your site

The php2shell.fyi checker reads the PHP version your site shows in public. A header is a hint, not proof. A distribution build often reports an old number, so confirm the package version on the server. A result never proves that a site is not exposed.

Sources