Control panels

PHP2Shell on aaPanel (宝塔) and 1Panel

Both panels ship their own PHP builds, including patched builds for PHP 7.4, 8.0 and 8.1 that the PHP project does not release. Updating the panel itself does not update the PHP that your sites use.

Last reviewed 2026-10-23

Updating the panel is not updating PHP

Each PHP version installed through the panel has to be updated and restarted separately. Check every version a site or project actually uses.

Fixed PHP builds per branch

First fixed panel builds, as published by the vendors. Reviewed 2026-10-22.

PHP branch宝塔 / aaPanel1PanelType
8.58.5.128.5.12Official PHP release
8.48.4.278.4.27Official PHP release
8.38.3.368.3.36Official PHP release
8.28.2.358.2.35Official PHP release
8.18.1.358.1.35Panel backport (not a PHP release)
8.08.0.318.0.31Panel backport (not a PHP release)
7.47.4.347.4.34Panel backport (not a PHP release)
7.37.3.34not offered宝塔 only, installed by script
7.27.2.35not offered宝塔 only, installed by script
7.17.1.34not offered宝塔 only, installed by script
7.07.0.34not offered宝塔 only, installed by script

Backport builds may still print the upstream number in php -v (1Panel’s 8.1.35, for example, contains PHP 8.1.34). Use the build shown in the panel. Sources: 宝塔 security guide, 1Panel app store commit. PHP 5.x: neither panel lists a fix; isolate those sites and migrate.

宝塔 / aaPanel

  1. Back up sites, databases and configuration.
  2. Open App Store → Installed (软件商店 → 已安装) and click Update app list (更新软件列表).
  3. Update every PHP version that a site uses to the build in the table. Upgrading the panel first is not required.
  4. Restart each updated PHP service, then check the version and your sites.
  5. PHP 7.0–7.3 cannot be updated from the App Store yet. 宝塔 provides a patch script; back up and test it before production use.
shell
# Every PHP version installed by 宝塔 / aaPanel
for p in /www/server/php/*/bin/php; do echo -n "$p: "; $p -r 'echo PHP_VERSION, PHP_EOL;'; done

# Restart the FPM service of each updated version (example: PHP 7.4)
/etc/init.d/php-fpm-74 restart

# PHP 7.0–7.3 only: 宝塔's patch script (back up first; use 71, 72 or 73 for other branches)
curl -fL -o php7_cve.sh https://download.bt.cn/install/php7_cve.sh && bash php7_cve.sh install 70

宝塔’s one-click hardening (Security Center, panel 13.1+) reduces only some attack paths and does not fix both CVEs, according to 宝塔. Nginx WAF 9.9.0 adds rules for both CVEs, but only in paid editions; use it alongside the patch, not instead of it.

aaPanel, the international edition, published a security notice with the same App Store steps and lists 8.1.35 and 7.4.34; at the time of that notice its 8.0 build was still in testing. Use the build that the App Store on your server offers and verify it.

1Panel

  1. Back up, ideally in a quiet period.
  2. Open the App Store and click Update remote apps (更新远程应用).
  3. In each PHP runtime, select the fixed version. Patched 7.4, 8.0 and 8.1 builds are labelled “1Panel patched”. If you do not see it, switch the major-version selector next to the app and reopen the list.
  4. Save, then restart the projects that use the runtime and verify the version.
shell
# 1Panel PHP runtimes are containers: list them with their image tags
docker ps --format '{{.Names}}\t{{.Image}}' | grep -i php

# PHP version inside a runtime container
docker exec <container> php -v

1Panel PHP runtimes are containers (1panel/php:<version>). Upgrading 1Panel itself does not change the runtime image of existing projects.

Questions

Is the 宝塔 PHP 7.4 / 8.0 / 8.1 build an official PHP release?+

No. The PHP project released only 8.2–8.5. 宝塔 and 1Panel built their 7.4, 8.0 and 8.1 packages from the PHP team’s source backports. They fix these two CVEs, but the branches stay end-of-life: plan a move to 8.4 or 8.5.

Does the 宝塔 WAF or one-click hardening replace the update?+

No. 宝塔 itself says one-click hardening only reduces some attack paths, and WAF rules cover known request patterns. Update PHP and restart the workers.

I updated 1Panel but my site still runs the old PHP. Why?+

Each website runtime is a separate container image. Select the fixed version in the runtime settings, save and restart the project.

Related