Update guides
Pick your platform. Each guide ends with the command to verify the result.
php2shell (CVE-2026-109618, CVE-2026-109619): what it is and how to fix it
php2shell is two critical PHP flaws (CVE-2026-109618, CVE-2026-109619, CVSS 9.2). See who is affected, the fixed versions, and how to check, update and verify.
How to check your PHP version, and what to compare it with
Find the PHP version your site really runs: php -v, a temporary test file, WordPress Site Health, cPanel, Plesk, DirectAdmin, apt, rpm, apk and Docker.
How to update PHP in cPanel and fix php2shell
Fix php2shell on cPanel: what shared-hosting customers can do, how to update EasyApache 4 ea-php in WHM, and how to update CloudLinux alt-php.
Update PHP on Plesk for php2shell (CVE-2026-109618 and CVE-2026-109619)
Plesk-provided PHP has php2shell fixes on Linux and Windows. How to install them, switch a domain's PHP handler, update OS-vendor PHP and verify.
Update PHP on DirectAdmin with CustomBuild
Patch PHP on DirectAdmin: the da update and da build php commands, how to handle each user's PHP selector, and how to verify the fix. Updated 22 Oct 2026.
Update PHP on Ubuntu and Debian for php2shell
Fix the php2shell PHP flaws on Ubuntu and Debian: fixed package versions per release, apt update commands, how to verify, and PPA/sury repo notes.
Update PHP on RHEL, AlmaLinux, Rocky Linux and Amazon Linux
How to patch PHP against php2shell on RHEL 8/9/10, AlmaLinux, Rocky, Oracle, Amazon Linux and Remi: current fix status, dnf commands, restart and verify.
Update your PHP Docker image for php2shell
Rebuild and redeploy your PHP containers for php2shell: which official php tags carry the fix, pinning digests, Compose and Kubernetes rollout, Alpine apk.
Update PHP on Amazon Linux for php2shell
Patch PHP on Amazon Linux 2023, Amazon Linux 2 and the 2027 Preview for php2shell: fixed package per ALAS, how to check, dnf or yum update, restart.
WordPress and php2shell: check your PHP version and update it
php2shell is a PHP flaw, not a WordPress one. Check your PHP version in Site Health, get your host to update it, test plugins first, and see what hosts say.
PHP 7.4, 8.0 and 8.1 are end-of-life: what is patched and what to do
php.net released no fixed versions for EOL PHP 7.4, 8.0 and 8.1, only source patches. See which distro back-ports cover them and how to upgrade to 8.2+ safely.
Does a WAF (Cloudflare, Sucuri, Imunify360) protect you from php2shell?
Cloudflare, Sucuri and Imunify360 added WAF rules for php2shell (CVE-2026-109618/109619). What each vendor says, what a WAF can't cover, and how to patch.