WHMCS and PHP2Shell

WHMCS runs on PHP, and PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), so a WHMCS update does not fix it. Install a fixed PHP release that your WHMCS version and ionCube Loader support.

Last reviewed 22 October 2026. Rules of 22 October 2026.

What fixes it

• A PHP update. Updating WHMCS does not update PHP.
• The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• WHMCS supports only some PHP branches, and each needs a matching ionCube Loader. The table below has both.
• The smallest change is the fixed release on the branch you already use, for example from 8.3.x to 8.3.36.

See your PHP version in WHMCS

1. Log in to the WHMCS Admin Area.
2. Go to Utilities › System › PHP Info.
3. The page shows the PHP version and the php.ini settings that the Admin Area uses.

If your WHMCS cron job uses the command-line PHP, that PHP can differ from the web PHP. Update both.

Which PHP release to install

PHP 8.2 gets security fixes only until 31 December 2026. If your WHMCS version supports 8.3 or 8.4, prefer one of those.

Still on PHP 8.1 or 7.x with WHMCS 8.13?

The PHP project ships no release with the fix for PHP 8.1 and older. The PHP security team published source backports for 7.4, 8.0 and 8.1 only. Some Linux distributions and hosts ship builds that include the fix and keep the old version number. Ask your OS vendor or host, or move to PHP 8.3.36 or 8.2.35. See Fixed versions.

Update in the right order

WHMCS files are encoded with ionCube, so each PHP version needs a matching ionCube Loader and WHMCS version. Work in this order:

1. Before you change PHP, open Utilities › System › PHP Version Compatibility. It lists encoded files that may not decode under a given PHP version. It does not check PHP syntax.
2. Upgrade the ionCube Loader to 15.0.0 before you update to WHMCS 9.1.
3. Update to WHMCS 9.1 before you move to PHP 8.4.

Utilities › Update WHMCS offers updates only while you run a compatible PHP version.

On shared hosting or cPanel, your host updates PHP. See cPanel, Plesk and shared hosting for what to ask.

After the update

• Restart PHP-FPM, Apache and every other PHP process. Old processes keep running the old PHP.
• Open Utilities › System › PHP Info again and confirm the new version.
• php2shell.com says memory disclosure can expose passwords, API keys and other secrets, even without code execution. If your WHMCS ran on an affected PHP, change the passwords and API keys it stores.

Technical notes

• php.net says every PHP install that serves web requests is at risk. It names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php as the highest risk, because a shown exploit runs before any application code.
• Remote code execution through PHP-FPM was confirmed for CVE-2026-109619, with a suitable application operation. Switching from mod_php to PHP-FPM is no fix.
• The researchers showed attacks on WordPress, Drupal and Joomla. They published none for WHMCS, which does not lower the risk: the flaw is in PHP.
• No configuration setting fully replaces the update. See Mitigations for interim steps.

Sources

• php.net security advisory, 21 October 2026
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• php.net: Supported versions
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• php2shell.com research
• WHMCS 9.1 system requirements
• WHMCS 9.0 system requirements
• WHMCS 8.13 system requirements
• WHMCS 9.1 release notes
• WHMCS docs: PHP Info
• WHMCS docs: PHP Version Compatibility

Check your site

Our checker reads the public response of your WHMCS site and reports any PHP version it can see. Check my site.