PHP2Shell: how to verify if cPanel, Plesk or CloudLinux are patched

Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619 and known as PHP2Shell, are under active exploitation. Anyone managing cPanel or Plesk hosting, or VPS with PHP installed manually, must immediately verify whether the package in use has already received the patch: the version number displayed on the website, in many cases, does not change.

What the two flaws are

The vulnerabilities are classified with a CVSS v4.0 score of 9.2. PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each with a CVSS v4.0 score of 9.2, and application-level authentication cannot block an attack: PHP processes the malicious request before any application code is executed. In practice the problem lies in the PHP engine itself, not in the CMS installed on top: CVE-2026-109618 arises from the fact that, after a failure in memory allocation, PHP leaves invalid data for the cleanup routine, whilst CVE-2026-109619 allows a PHP worker to reuse residual state from a previous request.

The risk is not theoretical: watchTowr has observed active exploitation in the wild of PHP2Shell, and urges immediate update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

The patched versions

PHP Branch	Patched version
PHP 8.2	8.2.35
PHP 8.3	8.3.36
PHP 8.4	8.4.27
PHP 8.5	8.5.12
PHP 7.4 – 8.1	no official release, backports only from package vendors
PHP 5.4 – 7.3	end of support, no patches from the PHP project

Anyone managing cPanel servers with CloudLinux has a way out even on unsupported versions: CloudLinux has published backports for the ea-php and alt-php packages covering PHP prior to 7.4 as well, without changing the version number displayed on the website. Verification must therefore be done on the installed RPM package, not on the PHP version number shown by phpinfo().

On directly managed systems, verification is done by reading the package changelog, for example with apt changelog php8.3-cli searching for references to the two CVEs, or the equivalent rpm -q --changelog command on RHEL, Rocky Linux and AlmaLinux.

What to do anyway

Updating PHP is not enough if the CMS remains vulnerable and vice versa: PHP, WordPress, PrestaShop, Joomla or other applications must be updated together, including themes and plugins. Anyone still using an officially unsupported PHP version (7.4 and earlier) should plan migration to 8.4 or 8.5, because emergency backports do not replace the regular security updates that those versions no longer receive.