Exposure assessment ≠ compromise detection. This guide cannot determine whether a particular system was compromised. Verify the current advisory and your exact runtime.

1. Establish scope before changing packages

  • Inventory domains, PHP handlers, FPM pools, nodes, container images and embedded runtimes.
  • Record the exact package revision, repository and operating system release.
  • Confirm a fix for both CVEs from the PHP project or your vendor.
  • Separate systems you administer from managed hosting that requires provider action.

2. Prepare a recoverable change

Back up application files, configuration and databases through the existing tested backup process. Confirm a restore path without exposing backup archives publicly. If an incident is suspected, preserve evidence before overwriting files or terminating processes.

Test framework, extensions and Composer requirements against the intended PHP release. Verify health checks, scheduled tasks, database connectivity, file permissions and key user journeys in staging. A branch upgrade deserves more compatibility testing than a same-branch security update.

3. Update using the correct deployment path

Use your distribution’s supported security repository, a verified upstream build, or a fixed container base image. Shared hosting and control panels may manage a separate PHP installation for each account or domain. The guides below cover those differences.

Do not paste a universal upgrade command into an unknown server. Identify the installed packages and services first. Review the proposed changes, package removals and repository source before accepting them.

4. Restart, redeploy and prove the change

  • Replace all affected processes, including old workers left behind during rolling deployment.
  • Confirm the web handler points at the intended binary or image digest.
  • Record the new revision, startup timestamp and advisory evidence.
  • Test traffic and application functionality, monitor errors, and check every instance.

5. Keep a rollback plan that accounts for security

Keep configuration and application rollback options. Returning to a known vulnerable runtime reopens the exposure; if the fixed deployment fails, restrict access while resolving compatibility or arrange another fixed build. Do not silently restore an exposed image to public service.

WAF rules, rate limits and configuration changes may reduce specific attack paths while the update is arranged. They do not repair PHP. Escalate a delayed patch and consider temporary access restrictions for affected services.

Choose your environment

WordPress

Verify your host’s PHP runtime, update safely, and validate WordPress after PHP2Shell remediation.

Laravel

Patch the PHP runtime supporting Laravel and verify Composer requirements, FPM, queues, workers and scheduled tasks.

Docker

Replace PHP container images with fixed builds, redeploy running containers and verify the serving image digest.

AWS

Identify PHP ownership across EC2, ECS, EKS, Elastic Beanstalk and managed AWS workloads, then deploy and verify a fixed runtime.

Ubuntu

Verify Ubuntu PHP2Shell backports and safely update an Ubuntu 24.04 PHP 8.3 FPM installation from official repositories.

Debian

Check Debian security package revisions and update the PHP runtime matching your release and service configuration.

Nginx

Trace Nginx FastCGI traffic to the real PHP-FPM service, update that runtime, and verify every upstream pool.

Apache

Distinguish Apache mod_php from proxy_fcgi deployments and patch the PHP module or FPM backend that serves the site.

PHP-FPM

Find PHP-FPM pools, verify the installed binary, apply the correct vendor patch and replace persistent workers safely.

cPanel

Verify per-domain PHP handlers and EasyApache package remediation in cPanel and WHM without confusing system PHP with site PHP.

Plesk

Map Plesk domains to their PHP handlers, update the correct vendor runtime and verify the active handler after remediation.

Cloudflare

Use Cloudflare WAF protections as a temporary defense layer while patching the underlying PHP runtime and checking origin access.

Shared hosting

Ask your hosting provider the right PHP2Shell questions, verify per-domain remediation and avoid unsafe account-level workarounds.

CHECK THE ORIGINAL GUIDANCE

Sources & further reading

PHP project · October 2026 security releases↗PHP advisory · Out-of-memory corruption↗PHP advisory · Stale global state↗Ubuntu · USN-8948-1↗Debian · DSA-6574-1↗

Advisory snapshot: 2026-10-22. Next review due: 2026-10-29. Recheck sources before acting; this site does not update advisories automatically.