Shared & managed hosting

PHP2Shell on shared and managed hosting

If someone else runs your server, they have to install the patched PHP. Your job: pick the newest PHP version for your site, check the exact version, and get your host to confirm.

Last reviewed 2026-10-22

Provider statuses change hourly

We list only what providers have publicly said. If your host is not here, it does not mean they are unpatched — ask them.

What to do

  1. Switch your site to the newest PHP version your panel offers (8.4 or 8.5 if available; test the site afterwards).
  2. Check the exact version the site runs — in your CMS (WordPress, Drupal, Joomla) or with the file below — and paste it into the checker.
  3. Ask your host to confirm the patch and the worker restart, using the message below.
  4. If they can’t (plan stuck on PHP 8.1 or older, no answer): put the site behind a WAF and plan a move.
php
<?php
// Save as v-<random>.php in your web root, open it in a browser, then DELETE it.
echo PHP_VERSION, ' ', PHP_SAPI, PHP_EOL;

Where to switch PHP versions

PanelWhereHow PHP gets patched
cPanelSoftware → MultiPHP Manager (or Select PHP Version on CloudLinux)ea-phpXY / alt-phpXY packages; cPanel said ahead of release it would push updates for ea-php74 – ea-php85 once upstream shipped (not yet confirmed).
PleskWebsites & Domains → PHP (PHP Settings)plesk-phpXY handlers, updated through the Plesk installer. Customers were still asking for an ETA on the Plesk forum on release day.
DirectAdminAccount Manager → PHP version selector (if enabled by the host)Builds via CustomBuild; the host has to rebuild PHP.
CloudLinux (behind many hosts)Select PHP Versionalt-php builds; CloudLinux said it would publish patched packages after the upstream release.
hPanel (Hostinger) and other custom panelsUsually Advanced → PHP ConfigurationPatched centrally by the host.

Server admins running these panels: commands are in the patch guide (cPanel and Plesk tabs).

Message for your host

email to your host
Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — patch status

Hi,

Please confirm that the PHP runtime serving my site(s) <domain> has been
updated to a release that fixes CVE-2026-109618 and CVE-2026-109619
(PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or a vendor build with the backport),
and that PHP-FPM / LSAPI workers were restarted afterwards.

If my account is on PHP 8.1 or older, please tell me which patched version
I can move to.

Thanks

Questions

Can I patch PHP myself on shared hosting?+

No. The host owns the PHP binaries. You can switch your site to a newer PHP version in the panel, but the patched builds have to be installed by the host.

My host only offers PHP 8.1 or older. What now?+

Ask whether they ship a vendor-backported build (CloudLinux and some panels do). If not, that host cannot protect you from PHP2Shell — plan a move, and put a WAF such as Cloudflare in front in the meantime.

Does selecting PHP 8.4 in cPanel fix it?+

Only if the host has installed the patched 8.4 build (8.4.27 or a backport). Selecting a branch does not update it. Check the exact version after switching.

Related