PHP2Shell: Critical PHP Vulnerabilities and Why VPS Owners Must Update Manually

Update: October 21, 2026, 16:45 UTC

PHP has released the fix. PHP 8.2 is patched in PHP 8.2.35. The other supported versions are fixed in PHP 8.5.12, 8.4.27 and 8.3.36. Read the details in PHP's security release announcement.

VPS customers using cPanel/WHM: cPanel has added the patched versions to EasyApache 4 (ea-php82 8.2.35, plus ea-php83, ea-php84 and ea-php85). cPanel also backported the fix to its PHP 7.4, 8.0 and 8.1 packages. Update through EasyApache 4 in WHM on your VPS, or through your server's normal package updates. See cPanel's EasyApache 4 change log for details.

Can't update right away? PHP has published temporary mitigations for both vulnerabilities in its security announcement. They reduce your exposure, but PHP calls them incomplete. Updating to a fixed version is the only complete fix.

What happened

On October 21, 2026, the PHP project released fixes for two critical remote code execution vulnerabilities in PHP itself, widely referred to as "PHP2Shell":

• CVE-2026-109618: memory corruption when PHP runs out of memory while a request is only partly set up.
• CVE-2026-109619: leftover internal state from one request can be reused by the next request handled by the same PHP worker. The confirmed paths involve PHP sessions.

PHP rated both 9.2 (CVSS v4.0) when it announced the release. They affect every common way PHP serves websites: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP says the risk is highest for Apache mod_php, where a demonstrated exploit works with an unauthenticated request before any website code runs.

That means this is not a WordPress plugin or theme problem. Any website running an unpatched PHP version can be exposed, including WordPress, WooCommerce, Laravel and custom PHP applications. Attacks against these two flaws have been reported since October 21.

Which PHP versions are fixed

PHP branch	Fixed version	Notes
8.5	8.5.12	Official PHP release
8.4	8.4.27	Official PHP release
8.3	8.3.36	Official PHP release
8.2	8.2.35	Official PHP release. PHP 8.2 reaches end of life on December 31, 2026.
8.1, 8.0, 7.4	No official release	PHP published source backports only. Use a vendor package that includes the fix (such as cPanel's EasyApache 4 packages) or upgrade to 8.2 or later.

Some Linux distributions and control panels backport the fix without changing the version number. If your version number looks old, check the package change log or build date before assuming you are exposed.

What GoDaddy is doing for its customers

Many of the businesses we work with host with GoDaddy, so here is where things stand according to GoDaddy's customer notice (last updated October 23, 2026):

• Web Hosting (shared hosting): GoDaddy says it has patched all PHP versions, as of October 22, 2026. No action is needed. Because a patched build can keep the same version number, GoDaddy suggests checking that your PHP build is dated October 21, 2026 or later.
• Managed WordPress: GoDaddy says it patched all PHP versions on October 21, 2026. No action is needed.
• VPS: GoDaddy says VPS customers manage their own server software and must update PHP themselves. It recommends backing up first, updating to a fixed release, restarting PHP and the web server, and checking the result. GoDaddy's paid Expert Services team can also do the update.

GoDaddy's notice does not mention dedicated servers by name, but its guidance for people who manage their own server applies the same way. This pattern is common across hosting companies: shared and managed plans get patched by the host, while VPS and dedicated servers are the customer's responsibility.

Why VPS servers need a manual update

On a VPS, you control the operating system and the software on it. That freedom is the point of a VPS, but it also means the host does not change your PHP version or restart your services without you. A VPS stays on the old, vulnerable PHP build until someone installs the update and restarts PHP. Installing the package without restarting PHP-FPM and the web server can leave the old code running.

How to update PHP on a cPanel/WHM VPS

1. Back up first. Take a server snapshot or full backup so you can roll back if a site breaks.
2. See which PHP versions are installed. In WHM, open MultiPHP Manager. From SSH, run rpm -qa 'ea-php*-php-cli' | sort.
3. Install the update. In WHM, open EasyApache 4 and apply the available PHP updates. From SSH on AlmaLinux, Rocky or CloudLinux 8 and later, run dnf upgrade 'ea-php*'. On CentOS 7 or CloudLinux 7, run yum update 'ea-php*'.
4. Restart PHP and Apache. Run /scripts/restartsrv_apache_php_fpm and /scripts/restartsrv_httpd.
5. Confirm the fix is installed. Check the package change log, for example rpm -q --changelog ea-php82-php-cli | grep CVE-2026-109618. Repeat for each PHP version on the server.
6. Test your sites. Load the home page, log in, submit a form and test checkout if you have one.

How to update PHP on a VPS without cPanel

• Ubuntu or Debian: run sudo apt update && sudo apt upgrade, then restart PHP-FPM (for example sudo systemctl restart php8.3-fpm) and your web server.
• AlmaLinux, Rocky or RHEL: run sudo dnf upgrade 'php*', then restart PHP-FPM and your web server.
• Docker: rebuild your images on a patched PHP base image and redeploy the containers. Restarting an old image does not fix it.
• Plesk or another control panel: use the panel's PHP or system updates, then confirm the fixed version is active for each site.

Run php -v and check each site's PHP version afterward. A server can have several PHP versions installed, and each one used by a website needs the fix.

If you can't update right away

PHP published temporary mitigations in its announcement. PHP is clear that they reduce exposure but do not make a server safe, so treat them as a stopgap for a few hours or days, not a replacement for the update. The main ones:

• CVE-2026-109619: turn off session upload progress with session.upload_progress.enabled = 0 in php.ini or the PHP-FPM pool (not in .user.ini or with ini_set()), then restart every PHP worker.
• CVE-2026-109618: keep request sizes small with post_max_size and upload_max_filesize, and enforce request-size limits at the web server or proxy. PHP's announcement also covers memory-limit settings, which need care.

On October 23, 2026, PHP also published an informational advisory about a related, unlikely session issue (CVE-2026-115560). It will be fixed in PHP's next regular release. The same setting, session.upload_progress.enabled = 0, mitigates it. Most sites are not affected, but if you already turned that setting off, leave it off.

Quick checklist

• Know which PHP versions every site on your server uses.
• Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package that includes the backported fix.
• Restart PHP-FPM and the web server.
• Confirm the fix through the package change log or build date.
• Plan an upgrade off PHP 8.1 and older, and off 8.2 before December 31, 2026.