PHP2Shell on Shared Hosting: Update PHP in cPanel and Plesk
If your site runs on shared hosting, you may be able to move it to a patched PHP version yourself. The exact menus depend on the host, but cPanel and Plesk both expose a PHP version selector. This guide covers the common paths, what to do when the host only offers an end-of-life branch, how to verify the switch, and an email template you can send to support.
Last updated:
Based on the official php.net advisory. This page contains no exploitation instructions.
Free checker
Check whether the hosting switch worked
Enter a public URL before and after changing the PHP version. The checker reads the version the site exposes. If the version is hidden, use Site Health or a temporary PHP file to confirm it on the server.
Free · No sign-up · We never store the URLs you check
The shared-hosting boundary
What you can change and what the host must change
On shared hosting, the hosting provider manages the system PHP packages and the web server. Your control panel may let you choose a PHP version for your account or for each domain. That selector usually changes the PHP-FPM pool or the Apache handler used by the site; it does not change the server's command-line PHP.
The panel cannot install a PHP release the host has not packaged. If the newest option is PHP 8.1 or older, you cannot reach a supported PHP2Shell release from the panel alone. Ask the host when a fixed branch will be available, or plan to move the site. The fixed upstream releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; a distribution may backport the fix into its own package.
Usually in your control
- The PHP branch assigned to a domain or account.
- Which PHP extensions are enabled for that branch.
- Application-level settings the panel exposes.
Usually managed by the host
- Installing PHP packages on the server.
- Restarting PHP-FPM and Apache workers.
- Which PHP branches the platform packages at all.
cPanel
Update PHP in cPanel
The common path is to log in to cPanel, search for PHP, and open Select PHP Version or MultiPHP Manager. Select PHP Version usually changes the account's PHP version and extensions. MultiPHP Manager lists domains and lets you assign a PHP version per domain. Hosts customize cPanel, so the labels and layout can differ.
Choose a fixed release in a supported branch, apply the change, and check that the extensions the site needs are enabled. Then verify the front-end version; do not assume the selector changed every domain. If the site uses a separate add-on domain or subdomain, check each one. If the panel offers a restart control for PHP-FPM or Apache, use it. If it does not, ask the host to confirm that the workers were restarted.
Typical cPanel sequence
- Back up the site and check plugin or theme PHP compatibility.
- Log in to cPanel and search for PHP.
- Open Select PHP Version or MultiPHP Manager.
- Choose a fixed release on a supported branch.
- Apply the change and enable the required extensions.
- Verify the web PHP version with Site Health or the checker.
Changing PHP can break plugins or themes that are not compatible with the new branch. Test on staging or a copy of the site first, and keep a backup.
Plesk
Update PHP in Plesk
In Plesk, open Websites & Domains, select the domain, and open PHP Settings. The current PHP version is shown at the top of the page, and the same page lets you switch versions and edit common settings. Plesk can assign a different PHP version to each domain or subscription, so check the site you are actually fixing.
Choose a fixed release, apply the change, and verify the web version. Some Plesk configurations run PHP as a FastCGI application or through PHP-FPM; the handler can affect which settings are available. If the version selector does not offer a supported branch, contact the host. The patch guide covers server-level updates for administrators who manage their own PHP packages.
Typical Plesk sequence
- Log in to Plesk and open Websites & Domains.
- Select the domain and open PHP Settings.
- Choose a fixed PHP release.
- Apply the change.
- Verify the PHP version for that exact domain.
Menu names can differ between Plesk versions and host themes. If you cannot find PHP Settings, search the Plesk documentation or ask the host for the exact path.
When the panel stops at an old branch
What to do if the host only offers PHP 8.1 or older
PHP 8.1 and older no longer receive supported releases from the PHP project. The project published minimal source backports for 7.4, 8.0, and 8.1, and some distributions ship patched packages, but a host that offers only an end-of-life branch is still running an unsupported runtime. Those backports are not a substitute for a supported release, and a passive checker cannot confirm them.
Ask the host whether it has a fixed release available on another plan. If not, compare the cost of moving to a host with supported PHP against the risk of staying. A site on PHP 8.1 or older is also exposed to future PHP vulnerabilities that will not be fixed for that branch.
A source backport can reduce exposure, but it is not a supported PHP release. If the host cannot confirm that the backport is applied and the workers were restarted, treat the site as unpatched.
Verification
Verify the switch from outside and inside
After the change, verify the web SAPI. Use the checker on this page, WordPress Site Health under Tools → Site Health → Info → Server, or a temporary file containing <?php echo PHP_VERSION; ?>. Delete the file immediately. A cached homepage or a CDN can hide a change, so check more than one page or bypass the cache.
If the version still looks old, the domain may be assigned to a different PHP pool, the worker may not have restarted, or the panel may have changed only the CLI version. Ask the host to confirm the PHP version and pool for the domain. The WordPress guide covers Site Health in more detail.
Contact support
Email template for your host
Replace the placeholder wording if you know your domain or plan name. The questions ask for the two facts a passive checker cannot see: the version the web server actually serves, and whether the workers were restarted.
Subject: PHP2Shell: PHP version and worker restart for my site
Hello,
I am checking my site against the PHP2Shell vulnerabilities
(CVE-2026-109618 and CVE-2026-109619). Could you confirm:
1. Which PHP version is my site actually serving through the web server?
2. Has it been updated to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35,
or to a distribution package with the backported fix?
3. Have the PHP-FPM and Apache workers that serve my site been
restarted since the update?
4. If no fixed release is available on my plan, which plan or
action do you recommend?
Thank you.If the host confirms a fixed release and a restart, verify the front end yourself as well. A support reply is useful, but the version that serves the site is the final check.
Keep reading
Related guides
Patch PHP2Shell
Server-level update and verification steps for Linux, Docker, and Windows.
Read guidePHP2Shell and WordPress
How to find the PHP version in Site Health and why WordPress updates are not enough.
Read guidePHP2Shell checker
The combined advisory, the fixed-version table, and temporary mitigations.
Read guideHow to check PHP version
CLI, phpinfo, cPanel, Plesk, XAMPP, and WordPress Site Health methods in one place.
Read guideFAQ
cPanel and Plesk questions
What shared-hosting customers can change, what only the host can change, and how to verify the result.
How do I update PHP in cPanel for PHP2Shell?
How do I update PHP in Plesk?
What if my host only offers PHP 8.1 or older?
Official references
- PHP security advisory (php.net)
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- PHP2Shell checker and fixed versions
- How to patch PHP2Shell
- PHP2Shell and WordPress
This guide summarizes the official PHP advisory for site owners. It is not a security audit. A patched PHP version does not by itself prove that a site is secure.
Check another site
The checker is free and does not require an account.