How to Update PHP on cPanel, Ubuntu & Docker (PHP2Shell Fix)

Updating PHP is the only complete fix for PHP2Shell. The patched versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Here is how to get there on the most common stacks. Always test on staging and take a backup first.

cPanel (EasyApache 4 / MultiPHP)

1. In EasyApache 4, make sure the patched version of your branch is installed.
2. Open MultiPHP Manager, select your domain, and set the PHP version.
3. If a domain is pinned to an old version, switch it to “Inherit” so it follows the server default — a common reason an update “doesn't take.”

Ubuntu / Debian (ondrej/sury repo)

Ubuntu's default repos carry only a few PHP versions. The standard route is the ondrej PPA (Ubuntu) or packages.sury.org (Debian):

sudo add-apt-repository ppa:ondrej/php
sudo apt update
sudo apt install php8.3 php8.3-fpm php8.3-mysql php8.3-xml php8.3-curl php8.3-mbstring
sudo systemctl restart php8.3-fpm
php -v   # confirm 8.3.36 or newer

Point your web server (Apache or Nginx) at the updated FPM socket, and restart it.

Docker

Bump the base image tag to a patched release and rebuild — don't rely on a floating :8.3 tag that may be cached:

# Dockerfile
FROM php:8.3.36-apache      # or php:8.3.36-fpm
# ... rest of your image
docker compose build --no-cache && docker compose up -d

Managed WordPress hosts

Most managed hosts (Kinsta, WP Engine, SiteGround, etc.) expose a PHP version switch in the dashboard and handle the restart for you. Many rolled the patched builds out automatically — but verify, don't assume.

End-of-life branches

PHP 8.1 and below received no patch. Plan a jump to 8.2+; see Step 4 of the fix guide.