How to fix PHP2Shell

This snapshot does not establish the status of other repositories, Ubuntu PPAs, Debian sid/forky or every third-party image. Later builds in the same official update channel may include these fixes; confirm the vendor advisory. The version checker conservatively asks you to verify vendor packages. AlmaLinux and RHEL rows apply to the named module stream; install that build or higher. Future fixes for retired streams are not guaranteed. Red Hat has additional advisories covering both CVEs, including RHSA-2026:87079 for RHEL 9 php:8.3. This table is a verified subset, not the complete Red Hat release list; check the advisory for your product and stream. The SUSE row covers only the Web and Scripting Module 15-SP7 (aarch64, ppc64le, s390x, x86_64). SUSE modules require the appropriate registered product and enabled repositories; they are included in the SLES subscription. Apply the advisory through YaST Online Update or zypper patch, then restart the actual PHP-FPM/Apache workers. A released PHP8 package does not establish that PHP7, SLE 16 or an SP6 installation without its required support channel is fixed.

# PHP processes running right now, and when they started
ps -eo pid,lstart,cmd | grep -E '[p]hp-fpm|[h]ttpd|[a]pache2|[f]rankenphp|[l]sphp'

# CLI and FPM can be different builds — check both
php -v
ls /usr/sbin/php-fpm* 2>/dev/null && for f in /usr/sbin/php-fpm*; do "$f" -v | head -1; done

# Is Apache running PHP in-process (mod_php)? That is the highest-risk setup.
apachectl -M 2>/dev/null | grep -i php

# PHP version inside every running container
docker ps --format '{{.Names}}' | while read c; do
  printf '%s: ' "$c"; docker exec "$c" php -r 'echo PHP_VERSION, PHP_EOL;' 2>/dev/null || echo 'no php'
done

Also check base images in your registry, CI runners, staging and preview environments, appliances that embed PHP, and old servers no one owns anymore. From the outside, curl -sI https://site | grep -i x-powered-by sometimes reveals the version, but most sites hide it. Use the NCSC-NL product inventory to find bundled PHP; confirm each product’s status with its vendor.

1. Best: migrate to PHP 8.4 or 8.5. If you must move fast, 8.3 is a smaller jump from 8.1 (8.2 leaves support at the end of 2026).
2. OS package: Ubuntu (including Pro / ESM), Debian LTS, RHEL and other LTS vendors may supply backports. Verify both CVEs for the exact package, release and support channel using the vendor advisory and changelog; then restart workers.
3. Building from source: the PHP team’s backport branches — PHP 8.1, PHP 8.0, PHP 7.4. They fix these two CVEs only; the branch stays unsupported.
4. Older branches: no PHP-project source backport is listed below this range. Distribution vendors may still provide fixes: Ubuntu confirms patched packages, including older branches through Pro / ESM. Confirm coverage of both CVEs and restart workers; if no patched build is available, isolate the host and migrate.

• Remove any temporary mitigations that hurt performance, e.g. pm.max_requests = 1 or memory_limit = -1, and go back to sane limits.
• Check for signs of earlier exploitation: detection guide. Patching does not undo a compromise.
• On PHP 8.2? Its security support ends 2026-12-31. Schedule the move to 8.4 or 8.5 now, while the upgrade path is fresh.

• Linux distro packagesFirst fixed PHP packages for PHP2Shell on Ubuntu, Debian, RHEL, AlmaLinux and SUSE, why the version can look old, and how to verify your build.
• Website & version checkerCheck a website’s public PHP signals by URL, or paste a PHP version. Understand PHP2Shell patch status, limits and what to ask your hosting provider.
• MitigationsExplore temporary PHP2Shell mitigations: memory and upload limits, upload progress, backtraces and cgroups, with their coverage and tradeoffs.
• Hosting providersPHP2Shell on shared and managed hosting: check and switch PHP versions in cPanel or Plesk, review provider updates and ask your host about patches.
• DetectionSignals of PHP2Shell exploitation, log searches you can run now, vendor detections, and what to do if you find signs of compromise.
• Cloudflare WAFCloudflare’s PHP2Shell WAF rule IDs for Free and paid plans, how to confirm they are active and blocking, and why you still need to patch PHP behind Cloudflare.
• session.upload_progressDoes disabling session.upload_progress stop PHP2Shell? Learn what it covers, where to configure it, how to verify it and what to restart.