Remediation

How to Patch PHP2Shell: Update PHP on Linux, Docker and Windows

Patching PHP2Shell means three things: install a PHP release that contains the official fix, restart every PHP worker so the old binary is no longer in memory, and verify the version through the web server. This guide covers those steps for Linux distributions, Docker, and Windows. It does not list distribution package versions; use your vendor's security notice for those.

Last updated: October 23, 2026

Critical updateFixed 21 Oct 2026Linux · Docker · Windows

Check a website PHP2Shell advisory

Based on the official php.net advisory. This page contains no exploitation instructions.

Free checker

Verify a site after the update

Enter a public URL after deploying the new PHP build. The checker compares the exposed version with the first fixed release in its branch. If the version is hidden, verify it on the server with Site Health, the hosting panel, or a temporary PHP file.

Free · No sign-up · We never store the URLs you check

The patch is three steps

Update, restart, verify

The official fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Every earlier release in those branches is affected. PHP 8.1 and older have no supported release. The full table is on the PHP2Shell checker.

Installing the package is not the end of the job. A running worker can keep the old binary in memory, and a passive check cannot see a distribution backport. Treat the update as complete only after the restart and the web verification.

1. Update

Install the fixed PHP release from your vendor, package manager, image, or php.net build.

2. Restart

Restart PHP-FPM, Apache mod_php, containers, or the Windows FastCGI process.

3. Verify

Check PHP_VERSION through the web server, not only with php -v.

Environment

Ubuntu and Debian

Update: Use apt to install the updated PHP packages for the branch you run. The distribution may publish the fix as a security update rather than a new upstream version. Check Ubuntu Security Notices or Debian Security Advisories for the CVE and the fixed package version.
Restart: Restart PHP-FPM and the web server. If the site uses several pools, restart the pool that serves the site. Package updates do not always restart every worker.
Verify: Check the version through the web server. A version with a package revision may already contain the backport even when the upstream number looks old. Confirm with the distribution advisory.

Environment

RHEL, AlmaLinux, and Rocky Linux

Update: Update the PHP packages with dnf. Red Hat's CVE pages and the distribution's errata are the place to confirm whether the fix has been backported to your package set. As with Debian and Ubuntu, the version string may not change even when the patch is present.
Restart: Restart PHP-FPM and the web server, then confirm that the service that serves the site is using the updated packages. A server can have several PHP streams installed at once.
Verify: Verify the web SAPI with a temporary PHP file, Site Health, or the checker. If the site uses a control panel, check the PHP version assigned to the domain as well.

The php.net advisory includes a specific warning about the volunteer-maintained rpms.remirepo.net repository: it would not have updates on the release day, and the advisory recommends switching to distribution packages or building PHP from source. If you rely on that repository, plan the migration rather than waiting for a package that may not arrive.

Environment

Docker

Update: Update the base image to a fixed PHP release, rebuild the image, and redeploy the containers. Check both the PHP image and any application image that bundles PHP. If the application image installs PHP from a distribution, update the distribution packages inside the build.
Restart: Stop the old containers and start the new ones. A running container keeps the old image in memory even if a new image is available on the host. Do not rely on copying files into a running container.
Verify: Check the web SAPI from inside the running container and from the public site. The CLI inside the container and the web server should match, but confirm both.

Environment

Windows

Update: Download the fixed PHP build from the php.net downloads page, replace the PHP binaries used by the web server, and restart the web server or FastCGI process. PHP on Windows is commonly served through IIS with FastCGI or through Apache; the restart step depends on that setup.
Restart: Restart IIS, Apache, or the FastCGI process manager. If you use a control panel or a bundled stack, update it through the vendor rather than copying files into a running stack.
Verify: Run php -v and verify the web SAPI with a temporary PHP file. Delete the file immediately. Keep the CLI and the web server on the same build where possible.

The step people skip

Restart every worker and prove the patch is live

An update is not complete until every PHP worker has restarted. Restart PHP-FPM, Apache with mod_php, php-cgi process managers, FrankenPHP, LiteSpeed, and any containers. A worker that keeps running can serve the old binary from memory even after the files on disk have changed.

Verify through the web server, not only with php -v. WordPress Site Health, cPanel or Plesk, a temporary PHP file, or the checker on this page can show the web version. If the version still looks old, check for multiple PHP installations, a per-domain pool, a cached page, or a worker that did not restart.

Web verification options

WordPress: Tools → Site Health → Info → Server.
Hosting panel: cPanel Select PHP Version or Plesk PHP Settings.
Temporary file: <?php echo PHP_VERSION; ?>, deleted immediately.
Remote checker: reads the version a public site exposes.

cPanel and Plesk guide WordPress guide All check methods

Keep reading

Related guides

PHP2Shell checker

The combined advisory, fixed versions, and temporary mitigations for both CVEs.

Read guide

cPanel and Plesk

Shared-hosting version switching, verification, and an email template for support.

Read guide

PHP2Shell and WordPress

Why WordPress updates are not enough and how to check PHP in Site Health.

Read guide

How to check PHP version

Every common check method, including the difference between CLI and web PHP.

Read guide

FAQ

Patch and verification questions

Short answers about package updates, worker restarts, and confirming the patch is active.

How do I patch PHP2Shell on Ubuntu or Debian?

Install the updated PHP packages from your distribution's security repository, restart PHP-FPM and the web server, and verify the web SAPI. Check Ubuntu Security Notices or Debian Security Advisories to confirm the fix was backported. The version string may not change.

Does updating PHP restart PHP-FPM automatically?

Not always. A package update may restart a service, but a container, a multi-pool setup, or a web server with mod_php can keep old workers. Restart every PHP worker and verify the web version.

How do I verify the patch is active?

Check the PHP version through the web server, not only php -v. Use WordPress Site Health, cPanel or Plesk, a temporary PHP file, or this checker. The fixed upstream releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; a distribution may backport the fix without changing the version string.

Official references

This guide summarizes the official PHP advisory for site owners. It is not a security audit. A patched PHP version does not by itself prove that a site is secure.

Check another site

The checker is free and does not require an account.

Back to the PHP version checker