Back up your application and configuration, and test in staging before applying a PHP vulnerability update. Use only the package source and branch actually installed on your system.
Vendor package status
| Branch / source | Confirmed package | PHP2Shell status |
|---|---|---|
| PHP 8.5 easyapache4 | See vendor advisory Source ↗ | Fix confirmed Checked at 2026-10-21 15:26:16 UTC |
| PHP 8.4 easyapache4 | See vendor advisory Source ↗ | Fix confirmed Checked at 2026-10-21 15:26:16 UTC |
| PHP 8.3 easyapache4 | See vendor advisory Source ↗ | Fix confirmed Checked at 2026-10-21 15:26:16 UTC |
| PHP 8.2 easyapache4 | See vendor advisory Source ↗ | Fix confirmed Checked at 2026-10-21 15:26:16 UTC |
| PHP 8.1 easyapache4 | See vendor advisory Source ↗ | Vendor backport confirmed Checked at 2026-10-21 15:26:16 UTC |
| PHP 8.0 easyapache4 | See vendor advisory Source ↗ | Vendor backport confirmed Checked at 2026-10-21 15:26:16 UTC |
| PHP 7.4 easyapache4 | See vendor advisory Source ↗ | Vendor backport confirmed Checked at 2026-10-21 15:26:16 UTC |
A confirmed advisory records vendor publication. It does not inspect your machine. Status not confirmed means no verified package threshold is recorded for that combination.
CloudLinux alternate PHP status
This package family has a separate vendor publication schedule. Confirm the exact source before applying a PHP vulnerability update.
| Branch / source | Confirmed package | PHP2Shell status |
|---|---|---|
| PHP 8.5 cloudlinux | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:18 UTC |
| PHP 8.4 cloudlinux | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:18 UTC |
| PHP 8.3 cloudlinux | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:18 UTC |
| PHP 8.2 cloudlinux | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:18 UTC |
| PHP 8.1 cloudlinux | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:18 UTC |
| PHP 8.0 cloudlinux | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:18 UTC |
| PHP 7.4 cloudlinux | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:18 UTC |
Which source installed your PHP?
EasyApache PHP and CloudLinux alternate PHP are separate package families. Confirm the runtime assigned to each domain; changing a selector alone does not patch another installed runtime.
This PHP vulnerability guide does not infer package publication from a source upload, a planned update or a release-candidate tag.
PHP 8.5: update, restart and verify
easyapache4
EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.
Checked at 2026-10-21 15:26:16 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.4: update, restart and verify
easyapache4
EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.
Checked at 2026-10-21 15:26:16 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.3: update, restart and verify
easyapache4
EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.
Checked at 2026-10-21 15:26:16 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.2: update, restart and verify
easyapache4
EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.
Checked at 2026-10-21 15:26:16 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.1: update, restart and verify
easyapache4
EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.
Checked at 2026-10-21 15:26:16 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.0: update, restart and verify
easyapache4
EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.
Checked at 2026-10-21 15:26:16 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 7.4: update, restart and verify
easyapache4
EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.
Checked at 2026-10-21 15:26:16 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗cPanel and shared hosting
Have the administrator update EasyApache 4, then check the runtime assigned to each website. The EasyApache interface documentation explains the update interface. This guide has not tested a licensed cPanel installation, so it provides no shell update command.
CloudLinux alternate PHP has a separate PHP vulnerability status. Ask the host for its package advisory rather than assuming the EasyApache update covers it.
If you cannot update immediately
Temporary mitigation is not a complete fix. A PHP vulnerability affecting web requests needs a verified runtime update. Have your administrator assess the availability and operational impact of these measures.
- PHP lists removing the memory limit, reducing accepted POST size, and disabling session upload progress as temporary measures. Removing the memory limit can exhaust host resources.
- For the branch covered by the advisory, PHP also lists disabling fatal-error backtraces. Correct recurring startup configuration warnings and restart all workers.
- Read the exact settings and limitations in the PHP security advisory before making configuration changes.
After the PHP security update
Test critical requests, application logs, scheduled tasks and background workers. Keep a record of the package source and revision used to resolve this PHP vulnerability. If the branch is end-of-life, plan the next supported-version migration.
Plan a supported-version migration →Common questions
Why does my PHP version still look old after updating?
Distribution vendors often backport a PHP vulnerability fix without changing the upstream version. Match the installed package revision to your vendor advisory and confirm the web runtime.
Does updating command-line PHP also update my website?
It depends on your installed runtimes. The command line, PHP-FPM and a hosting panel can use different binaries. Verify the runtime serving each website after the PHP security update.
Do I need to restart PHP workers?
Yes. Follow the vendor restart procedure for all serving workers, including PHP-FPM, Apache and long-running application workers. A package update alone does not prove every process is running the new runtime.