How to patch PHP2Shell on cPanel and WHM servers

Who this guide is for

• Server owners and resellers with WHM root access — follow every step.
• cPanel users on shared hosting — you can’t patch PHP yourself. Jump to if you only have cPanel access.

Shared servers host many sites on the same PHP builds, which makes them a prime PHP2Shell target. Patch these first.

1. See which PHP versions are installed and used

In WHM, open Software → MultiPHP Manager: it lists each installed ea-php version and which domains use it. From the shell:

ls /opt/cpanel/ | grep ea-php
/opt/cpanel/ea-php83/root/usr/bin/php -v

Repeat the second command for each installed version.

2. Update the EasyApache 4 PHP packages

EasyApache 4 PHP builds are regular system packages, so update them with the OS package manager:

# AlmaLinux / Rocky / CloudLinux 8+ cPanel servers
sudo dnf upgrade 'ea-php*'

# Older CentOS 7 / CloudLinux 7 servers
sudo yum update 'ea-php*'

# Ubuntu cPanel servers
sudo apt update && sudo apt install --only-upgrade 'ea-php*'

Then confirm each version again with /opt/cpanel/ea-phpXX/root/usr/bin/php -v. If an installed branch has no update available, check cPanel’s release notes and your server’s update settings before moving on.

3. Update CloudLinux alt-php and LiteSpeed lsphp (if used)

CloudLinux’s PHP Selector uses separate alt-php builds, and LiteSpeed Web Server uses lsphp. Both are separate from EasyApache — patch them too:

sudo dnf upgrade 'alt-php*'     # CloudLinux PHP Selector builds
sudo dnf upgrade 'lsphp*'       # LiteSpeed PHP builds (package names vary by setup)

4. Restart PHP and the web server

/scripts/restartsrv_apache_php_fpm
/scripts/restartsrv_httpd

On LiteSpeed servers, restart LiteSpeed as well (/usr/local/lsws/bin/lswsctrl restart) so new lsphp processes start.

5. Move accounts off end-of-life PHP

ea-php81, ea-php80, ea-php74 and older will not get an official PHP2Shell fix. In MultiPHP Manager, switch those domains to ea-php83 or newer after a quick test of each site, then consider removing the old versions from EasyApache 4 so they can’t be selected again.

6. Verify

Check a site through the web, not just the CLI: WordPress sites can use Tools → Site Health → Info → Server, or drop a temporary <?php echo PHP_VERSION; file into a document root, load it, then delete it. For the server-side binaries:

npx php2shell-checker@latest --local --php /opt/cpanel/ea-php83/root/usr/bin/php

If you only have cPanel access

Only your hosting provider can install patched PHP builds. What you can do today:

1. In cPanel, open MultiPHP Manager or Select PHP Version and move your site to the newest PHP version offered (8.3 or later).
2. Ask your host to confirm their PHP builds are patched for CVE-2026-109618 and CVE-2026-109619 — there’s a copy-paste email in our WordPress guide.
3. Keep your own site clean: update your CMS and plugins and change your passwords after the host confirms the patch.

After patching

Because one compromised account can affect a whole shared server, run the compromise checklist across all document roots — look especially for new .php files in upload directories.

Managing many cPanel servers? We can help.