How to update PHP in cPanel and fix php2shell

Only check systems you own or are responsible for.

Short answer

cPanel shipped fixed PHP packages on 21 Oct 2026 in EasyApache 4 25.91: ea-php82 to ea-php85 are updated, and the end-of-life ea-php74, ea-php80 and ea-php81 got backported fixes (cPanel release notes, EasyApache 4 change log). If you run the server, update the ea-php* packages and restart PHP. If you are a shared-hosting customer, you cannot install the patch yourself: your host must, and your job is to be on a supported PHP branch and ask them.

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution. PHP says there are no complete mitigations: updating is the only safe choice.

Which one are you?

Shared hosting customers

1. See which PHP your sites use

Open MultiPHP Manager in cPanel. It lists each domain with its PHP version and lets you change it. The menu only offers versions your host has installed for your account (cPanel docs). If your host runs CloudLinux you may see Select PHP Version instead, which switches between CloudLinux alt-php builds.

2. Be on a branch that has a fix

• PHP 8.2, 8.3, 8.4, 8.5: upstream fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (php.net). 8.2 only gets security fixes until 31 Dec 2026 (supported versions), so 8.3 or newer is a better home.
• PHP 7.4, 8.0, 8.1: end of life at php.net. cPanel backported the fix on its servers, but the version number does not change, so you cannot tell from 7.4.33 / 8.0.30 / 8.1.34 whether the fix is in. Plan a move to a supported branch.

Before you change a live site’s PHP version, take a backup (cPanel Backup or your host’s tool) and test on a staging copy or a low-traffic domain. A jump across several PHP versions can break old plugins and themes.

3. Ask your host to confirm

Selecting a branch does not patch it. The fix arrives when the host updates the server’s packages. Send them this:

Has EasyApache 4 25.91 (or later) been installed on my server, so that ea-php82 to ea-php85 are at 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 or newer (CVE-2026-109618 and CVE-2026-109619)? If we use CloudLinux alt-php, have the fixed packages been installed and PHP restarted?

Check the hosting status page to see what we have found for common hosts. You can also type your PHP version into the checker (it only compares what you type, in your browser).

If the answer is “no” or “we don’t know”, move your site to a host that patches promptly. Cloudflare’s default WAF protection or a similar service is an extra layer only; Cloudflare itself says to patch PHP anyway.

Server admins: WHM and EasyApache 4

Fixed packages

These are the Version-Release values from cPanel’s own %changelog. The built package name carries a distro suffix, for example ea-php84-php-8.4.27-1.el9.cpanel.

Sources: the %changelog of cPanel’s spec files for ea-php85, ea-php84, ea-php83, ea-php82, ea-php81, ea-php80 and ea-php74.

Distro packages keep older upstream numbers because fixes are back-ported. For ea-php74, ea-php80 and ea-php81 the PHP version printed by php -v stays the same, so compare the release number (-19, -12, -5), not the upstream number. On CloudLinux, CloudLinux builds its own ea-php packages with lower numbers (for example ea-php84 8.4.26-2.elX.cloudlinux.1) that carry the fix as a backport, so do not judge them unpatched from the numbers above; check the package changelog for the CVE IDs. More in the fixed-versions table.

cPanel also updated the PHP inside cPanel & WHM itself (it affects cPanel’s own interfaces, including Roundcube webmail): cPanel & WHM 138.0.18, 136.0.50 and 134.0.66 include PHP 8.4.27, and 110.0.153 includes backported fixes for PHP 8.1.34 (cPanel release notes). That is separate from the ea-php* packages that serve your sites.

Update

cPanel’s release notes say to install the update but give no separate customer steps, so use your normal package update. Take a snapshot or backup first.

# 1. What is installed now (AlmaLinux / Rocky / CloudLinux / RHEL family)
rpm -qa 'ea-php*-php' --qf '%{NAME}-%{VERSION}-%{RELEASE}\n' | sort

# 2. Pull the update. Read the transaction list before you confirm it.
dnf clean expire-cache
dnf upgrade 'ea-php*'        # use yum on EL7 / CloudLinux 7

# Ubuntu-based cPanel servers use apt instead:
# apt update && apt install --only-upgrade 'ea-php*'

If nothing is offered, your mirror may not have 25.91 yet; run dnf clean all, try again later, and confirm against the table above. Do not force it with -y on a production server without reading what would be removed.

Restart PHP, then verify

Running PHP workers keep the old code in memory until they restart.

/scripts/restartsrv_apache_php_fpm
/scripts/restartsrv_httpd
# LiteSpeed (lsphp) servers: restart LiteSpeed the way you normally do.

# Verify: installed packages, then the binary of each branch you use
rpm -qa 'ea-php*-php' --qf '%{NAME}-%{VERSION}-%{RELEASE}\n' | sort
/opt/cpanel/ea-php84/root/usr/bin/php -v

Match the output against the table. For 8.2 to 8.5 the binary should print the fixed upstream version or newer. Then confirm the website itself is served by the new build (for example by checking the PHP-FPM master process start time), since command-line PHP can differ from what the site uses. You can also enter the versions in the checker.

CloudLinux alt-php

CloudLinux says fixed alt-php packages are now in its stable repositories; its status page lists the release as complete on 22 Oct 2026 at 00:07 UTC. A regular update now installs them:

• CloudLinux OS 7, 8 and 9: alt-php 5.2 to 5.6, 7.0 to 7.4 and 8.0 to 8.5.
• CloudLinux OS for Ubuntu 22.04: alt-php 5.2, 5.6, 7.0 to 7.4 and 8.0 to 8.5.
• CloudLinux OS 10: alt-php 5.2 from the stable repository; the other versions come from the ELS ALT PHP repository.
• CloudLinux 6: not confirmed yet.

CloudLinux does not publish exact alt-php package version strings. The packages carry the fix as a backport and keep their own lower version numbers, so confirm the fix in the package changelog, not by comparing numbers. Commands from CloudLinux’s status page, then restart Apache, PHP-FPM or LiteSpeed (LSAPI):

# CloudLinux OS 7
yum clean all && yum update "alt-php*"
# CloudLinux OS 8, 9 and 10
dnf clean all && dnf upgrade "alt-php*"
# CloudLinux OS for Ubuntu
apt-get update && apt-get upgrade

# check the changelog (example for alt-php74)
rpm -q --changelog alt-php74-common | grep -E "CVE-2026-(109618|109619)"

Security-only updates (yum --security) do not list these packages yet, per CloudLinux. Read the CloudLinux post for the latest.

php.net also lists interim, partial hardening settings (see the php.net advisory); they reduce exposure but do not fix the flaws. If you run Imunify360 with its WAF enabled, its rulesets 8.83 to 8.85 are an interim mitigation, not a fix, and CloudLinux says its rules cover only part of the issue (CloudLinux). Update the packages.

Related

• Checker - compare a PHP version you type against the fixed versions
• Fixed versions - upstream and distro tables
• Hosting status - what hosts and panels have said

Need this done for your exact setup? We offer a $49 personal patch plan: written steps for your exact setup by email within 24h. See the plan. We never log in to your server.

Independent site, not affiliated with cPanel, CloudLinux, the PHP Group or php.net.