PHP2Shell.fyi Check a site

Plesk

PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). Plesk can run several PHP versions side by side: its own builds and the PHP from your Linux vendor. Find the one that serves your site, update it and restart it.

Last reviewed . Rules of .

What to know first

See the PHP of a site

  1. Log in to Plesk and go to Websites & Domains.
  2. Find the domain and click PHP.
  3. The page shows the PHP version and the handler, such as FastCGI or PHP-FPM.

The panel shows the branch you picked, such as 8.3. Read the exact build on the server, below, or in a short phpinfo() test.

See every PHP on the server

For server administrators. Tools & Settings › PHP Settings lists the PHP handlers on the server. On the command line:

# every Plesk PHP build on the server
    find /opt/plesk/php/*/bin/php
    # exact version of one build (use your version)
    /opt/plesk/php/8.3/bin/php -v
    # PHP handlers that Plesk knows
    plesk bin php_handler --list

A plain php -v runs the PHP from your operating system, not a Plesk build. It can show a different version from the one your site uses. Use the full path.

Update PHP

Plesk treats PHP as a third-party component. Plesk's automatic updates install these only when you turn that on in Tools & Settings › Update Settings. Plesk calls the System Updates tool the main way to manage third-party components. So check that the PHP update arrived.

plesk installer --select-release-latest --upgrade-installed-components

Then check every build again with /opt/plesk/php/<version>/bin/php -v. You need 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later in the same branch. If a build still shows an older number, ask Plesk support whether that build has the fix.

A newer branch: Tools & Settings › Updates › Add/Remove Components, then Web hosting › PHP interpreter versions. Plesk sets up the handlers for the new version. Then switch each site to it on its PHP page.

PHP from the OS vendor: it updates with your Linux packages. See Ubuntu, Debian or RHEL, AlmaLinux and Rocky Linux.

Outdated PHP versions: Plesk offers secured handlers for end-of-life PHP from TuxCare, in packages whose names start with alt-php. It is a paid extension, and the packages update through System Updates. Ask TuxCare or your host whether your alt-php build contains the CVE-2026-109618 and CVE-2026-109619 fix.

Restart PHP

systemctl restart plesk-php83-fpm

A running PHP process keeps the old code in memory until it stops. Restart Apache, every PHP-FPM pool and any long-running PHP workers, such as queue workers (php2shell.com). In a container, rebuild the image and recreate the container (our advice).

Check your site

The php2shell.fyi checker reads the PHP version your site shows in public. A header is a hint, not proof. A distribution build often reports an old number, so confirm the package version on the server. A result never proves that a site is not exposed.

Sources