PHP2Shell patching for cPanel and Plesk servers

Start with three different layers

A hosting panel can manage the website runtime while also running its own administration software. The operating system may supply another PHP interpreter used by command-line tasks. Add alternative PHP packages, per-domain handlers or containers, and one server can contain several independent update targets. Treat “we updated the panel” as a description of an action, not automatic proof that each target was corrected.

This runbook assumes you are the authorised server administrator. A shared-hosting customer should ask the provider to perform server-level work. Do not bypass the panel’s package management because a command for another Linux distribution appeared in a search result. A supported update channel is part of the security evidence, not administrative decoration.

Build a domain-to-handler inventory before changing defaults

In cPanel & WHM, MultiPHP Manager exposes system and domain-level PHP settings. Its documentation distinguishes inherited defaults from explicit account settings; changing a global default does not necessarily change existing domains. It also notes that an active LiteSpeed installation uses lsphp. Record the actual handler assigned to each production site, subdomain and staging service rather than assuming the default applies everywhere.

For Plesk, collect the installed PHP handlers and the PHP selection for each relevant domain through supported panel or administrator tooling. Identify operating-system packages separately from Plesk-supplied ones. An unused old handler is still worth recording: decide whether to update it or remove it through the supported process so a later configuration change cannot reactivate a vulnerable runtime.

• List public domains and the business service each one supports.
• Record the package supplier, installed PHP build, handler and associated process service.
• Include scheduled tasks, custom integrations and administration components.
• Identify who can perform updates and who can test the application afterwards.
• Mark unassigned or unused runtimes for supported retirement rather than leaving an unexplained exception.

cPanel: keep EasyApache packages and the active handler aligned

Use the current EasyApache and WHM update workflow appropriate to the server’s supported operating system and package provider. Review available PHP package updates and the proposed transaction, then apply the vendor-supported security correction. Retain the package revisions and update output. If CloudLinux or another supported supplier owns the relevant alternative PHP build, obtain that supplier’s fix mapping instead of treating an EasyApache result as evidence for a different package family.

After installation, replace the processes that actually serve the sites. cPanel documents the following restart command for its Apache PHP-FPM service. Use it only when that is the identified serving method and when a controlled restart has been planned. It is not an instruction for shared-hosting customers and it does not stand in for LiteSpeed’s own runtime-management procedure.

/usr/local/cpanel/scripts/restartsrv_apache_php_fpm --hard

Monitor the restart and verify every affected service returns successfully. Do not delete PHP-FPM temporary directories to force a refresh: cPanel warns that manually removing its PrivateTmp-created directories can cause application errors. If a site fails, inspect its relevant service and application logs before changing package origins, permissions or handler settings at random.

Plesk: include website handlers and the panel engine

Plesk’s PHP2Shell advisory checked on 22 October 2026 covers its PHP packages and the panel’s engine. The advisory identifies Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4 as corrected panel-engine releases. It also documents fixed website PHP packages and specific legacy build mappings. Reopen the current advisory before acting, since applicability depends on platform and release.

Follow the supported Plesk update procedure for the installed release and operating system. Confirm the panel-engine correction separately from the packages assigned to websites. Apply the appropriate PHP component updates, then verify domain assignments and active runtime state. Do not copy a Linux package command to a Windows Plesk server; the service and update mechanisms differ.

Where an older PHP version retains its familiar version number, use Plesk’s exact documented build mapping rather than assuming any recent build is safe. A vendor-specific backport is not a general promise of ongoing upstream support. Put migration to a supported application/runtime combination on the follow-up plan, with an owner and target date.

Plan a short, observable maintenance change

1. Confirm current configuration, account ownership and a recoverable backup before the transaction.
2. Notify the person who can approve business downtime and identify the functions that need testing.
3. Apply updates through the responsible vendor channel and save the full completion record.
4. Replace each affected runtime service or handler using the correct panel-supported method.
5. Verify the public request route, test application behaviour and monitor the initial recovery period.
6. Keep failed or unverified services isolated rather than silently returning them to the public pool.

A backup is useful only if it can be restored under a safe runtime. For rollback, prefer a compatible corrected handler or a static maintenance route. Restoring the vulnerable package to make an error disappear would reopen the original issue. If a handler migration is required, test extensions, configuration differences and application compatibility rather than selecting another version solely because it is listed in a dropdown.

Verify the domain, not just the server’s default PHP

A successful panel login and a green update notification do not prove that the customer website now uses the intended interpreter. Check a protected dynamic path on each affected domain. Compare the web SAPI, assigned handler and package identity with the inventory. Avoid leaving public phpinfo files or status endpoints behind as part of the evidence collection.

Maintain separate results for each affected runtime family. This prevents the most common administrative shortcut: using one successful page request as evidence for dozens of differently configured domains.

Test the business workflows the panel cannot validate

Hosting tools can report service state, but they cannot know whether a payment callback, customer login or enquiry workflow remains correct. Agree a small test set with the site owner. Use non-sensitive test content and approved provider test modes. Verify both the response shown to the visitor and the intended backend result; an attractive success message is not proof that the expected message or transaction arrived.

• Confirm dynamic pages render without new PHP warnings or 5xx responses.
• Check session-based functions and any framework cache behaviour.
• Test enquiry submission and expected error handling with a designated test mailbox.
• Check scheduled jobs and integrations that may use a different CLI interpreter.
• Monitor application errors and resource use after traffic returns.

Example: one account has an explicit legacy handler

Consider a hypothetical agency server with a dozen domains. The administrator updates the default PHP branch and confirms the panel’s own correction. One older customer domain still has an explicit handler assignment, so it is excluded from the first verification pass. The inventory reveals this instead of letting it remain a hidden exception. The team obtains that handler’s supported fix or moves the application to a tested corrected runtime.

The handover names the domains, runtime suppliers, package or component revisions, restart evidence and outstanding migration work. It also records whether earlier exposure needs investigation. This is useful security work even when the websites look exactly the same afterwards: the material change is in the runtime and its verified use, not the visual design.