How to Fix PHP2Shell: Complete Patching Guide (CVE-2026-109618 & 109619)

The only complete fix for PHP2Shell is to update PHP to a patched version. Application-level patches, plugins and “maintenance mode” do not help, because the bug is in the PHP engine and runs before your application code. Here is the full process.

Step 1 — Find your current PHP version

Pick any of these:

• Run our free PHP2Shell scanner (reads the public version banner).
• SSH into the server and run php -v and php-fpm -v.
• cPanel → MultiPHP Manager. Plesk → PHP Settings.
• WordPress → Tools → Site Health → Info → Server.

Step 2 — Compare against the patched releases

You are safe only if you are at or above the patched version for your branch:

On PHP 8.1 or older? There is no patch for that branch — go to Step 4.

Step 3 — Update PHP, then restart

Update within your branch (for example 8.3.x → 8.3.36) — point releases are safe, backward-compatible, and the fastest path. Then restart your handler so the new binary is actually loaded:

# PHP-FPM
sudo systemctl restart php8.3-fpm
# Apache mod_php
sudo systemctl restart apache2

Environment-specific instructions are in How to update PHP on cPanel, Ubuntu & Docker.

Step 4 — On an end-of-life branch (8.1 and below)

These versions get no fix. Upgrade to 8.2+ (ideally 8.3 or 8.4). Because major-minor jumps can break code, test on a staging copy first, update your dependencies, then switch production. If you truly cannot move yet, ask your hosting provider whether they backport security fixes.

Step 5 — Verify

Run php -v again (and re-scan) to confirm the new version is live on the exact SAPI that serves your site — CLI and web can differ. Don't trust the dashboard alone; confirm on the running handler.