Update PHP on DirectAdmin with CustomBuild

Only check systems you own or are responsible for.

Short answer

DirectAdmin released a CustomBuild update on 21 Oct 2026 that bumps PHP 8.5, 8.4, 8.3 and 8.2 to their latest versions and adds patches for PHP 8.1, 8.0 and 7.4. A later build the same day added patches for PHP 7.3, 7.2, 7.1, 7.0 and 5.6 and a small fix for the PHP 8.1 compilation. DirectAdmin staff say the PHP upgrade is not automatic: run da update, then da build php (unless you have the CustomBuild cron enabled).

The two flaws (CVE-2026-109618 and CVE-2026-109619) are rated critical and can allow unauthenticated remote code execution, per the php.net advisory. That means a stranger could run code on your server through a web request. Only an update is a complete fix.

What is patched in CustomBuild

CustomBuild compiles PHP from source, so for 8.2 to 8.5 the number in php -v is the upstream release number and you can compare it directly with the table above. This is different from distro packages (apt, dnf), which keep older numbers because fixes are back-ported: for those, compare with the vendor’s fixed package version on our fixed versions page.

Step 1: Snapshot, then update

Take a server snapshot or backup first. This matters most if you change a PHP branch (for example 8.1 to 8.3), because applications can break on a new major version.

da update
da build php

da build php recompiles every PHP version configured in CustomBuild, so it can take a while on a server with several. To see which versions are configured:

grep -E '^php[0-9]_(release|mode)=' /usr/local/directadmin/custombuild/options.conf

(CustomBuild stores its settings in options.conf, and DirectAdmin’s docs show the php1_release to php9_release slots in Multiple PHP versions.)

Step 2: Check the per-user PHP selector

DirectAdmin lets users pick their PHP version on the Domain Setup page from the slots you enabled. Subdomains can have their own choice via Document Root Override. This is where servers get missed: patching slot 1 does not help a site that selected an old slot.

1. Look at every *_release line from the grep above. Each one that is not no is a PHP version a user can run.

2. Make sure each one is a patched branch (8.2 to 8.5, or an older branch with the new patches). Prefer 8.2 or newer: 8.1 and older are end of life at php.net. Change a slot with, for example:

   da build set php2_release 8.3   # example: slot 2 to 8.3
   da build php
   da build rewrite_confs

3. Retire slots you do not need with da build set php3_release no and da build rewrite_confs. Move users off a slot before you disable it. DirectAdmin documents a script that swaps every user’s selection and recommends backing up /usr/local/directadmin/data/users/*/domains/*.conf first.

4. If you run CloudLinux with php1_mode=lsphp, users can also pick a version in the CloudLinux PHP Selector. CloudLinux’s alt-php packages come from CloudLinux, not from the CustomBuild PHP versions above, so check those against CloudLinux’s own status, and see our hosting status page.

Step 3: Restart PHP and verify

Restart the PHP-FPM service for each version in use. DirectAdmin’s PHP-FPM docs show the unit name as php-fpm plus the version digits:

systemctl restart php-fpm83

Repeat for each version (php-fpm84, php-fpm82 and so on). If any domain uses mod_php or lsphp instead of PHP-FPM, restart the web server too. The service name depends on your setup (often httpd or apache2); list it with systemctl list-units | grep -E 'httpd|apache'.

Then verify:

da build versions
ls -d /usr/local/php*
/usr/local/php83/bin/php -v

The ls shows which PHP installs exist. Run php -v from each one, replacing php83 with the folder name.

• 8.5 to 8.2: the php -v number must be at least the fixed version in the table. Paste it into our checker to compare it in your browser. The checker never contacts your server.
• 7.4: DirectAdmin staff say that if custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch exists and CustomBuild shows no update for 7.4, you are up to date. php -v still prints the old number (7.4.33).
• 8.1, 8.0 and 7.3 to 5.6: the number does not change, and DirectAdmin has not published a file name or version string for them. Run da update and da build php again and confirm da build versions shows no pending update.
• In the da build versions list, staff say an asterisk marks the same PHP version with new patches added. Forum users were unsure how to read it, so do not rely on it alone.

If something goes wrong

• da build versions still shows the old number. Run da update first, then da build versions again. The PHP upgrade is not automatic unless the CustomBuild cron is enabled (DirectAdmin staff).
• PHP 8.1 fails to compile. Staff said PHP 8.1 does not build cleanly on some systems with the first patch, and a later build adds a small fix for the PHP 8.1 compilation. Run da update, then da build php again. If it still fails, move those sites to 8.2 or newer.
• Old operating system. For the legacy channels, DirectAdmin staff say a new build was pushed to the rhel7 and debian10 release channels with the latest PHP versions and all security patches, so run da update again. A newer build for those channels (22 Oct, about 06:18 UTC) fixes the patching order on servers that use LiteSpeed, where patches failed to apply in lsphp mode before.
• Cannot update yet. The php.net advisory lists measures that reduce exposure to specific attack paths, but says they do not make an installation safe. Treat them as a stopgap.

For the latest status, watch DirectAdmin’s Critical PHP updates announcement thread.

Want it done for your setup?

We also offer a $49 personal patch plan: written steps for your exact setup by email within 24h. See /fix-service/. This guide is independent and not affiliated with DirectAdmin or the PHP Group.