PHP2Shell on Shared Hosting and cPanel: What You Can Do and What Your Host Must Do

By Umair Ali Sadaqat · Updated · Editorial policy

On shared hosting you cannot patch PHP yourself. What you control in cPanel or Plesk, what only the host can fix, and the exact questions to send your host after Black October.

Most small business sites live on shared hosting: one server, many customers, and a control panel such as cPanel or Plesk. On that kind of account you do not own PHP. The host compiles it, the host patches it, and you choose from the versions they offer. That changes what "fix PHP2Shell" means for you. (What the flaws are: see the Black October overview.)

What only your host can do

  • Install the fixed PHP builds (8.2.35, 8.3.36, 8.4.27, 8.5.12, or their own patched builds of older branches).
  • Restart the PHP handlers so the old builds leave memory. On LiteSpeed servers this includes the LiteSpeed PHP processes; the advisory lists LiteSpeed among affected setups.
  • Apply server-wide temporary settings if patching is delayed.

You cannot do any of this from an ordinary account, and nothing you upload fixes it.

What you can do in the panel

Pick a supported branch. In cPanel, open MultiPHP Manager or Select PHP Version (CloudLinux servers). In Plesk, open your domain's PHP Settings. If your site is on 7.x, 8.0 or 8.1, moving to 8.2 or newer puts you on a branch with an official fix, as long as your site's software supports it. Take a backup first; the panel's Backup tool or your host's snapshot feature will do.

Check the real version. The panel often names only the branch. Upload a one-line file that prints PHP_VERSION, open it, then delete it. Our PHP version guide shows how.

Do not rely on .user.ini or php.ini overrides in your folder. The PHP team says the session.upload_progress workaround is not effective through .user.ini, because it has to apply before PHP parses the request. Only the host's server-level configuration does that. The stopgap guide explains the measure if you want to ask for it.

The message to send your host

Copy this and adjust:

Hello, my account is [account name / domain]. Regarding the PHP security release of 21 October 2026 (CVE-2026-109618 and CVE-2026-109619): 1. Which PHP versions on my server include the fix, and when were they installed? 2. Have all PHP handlers, including LiteSpeed or PHP-FPM processes, been restarted since? 3. My site uses PHP [your version]. Is that build patched? If not, which version should I switch to? 4. Did you see any suspicious activity on my account before the patch?

Keep the reply. If the host cannot answer the first question clearly within a day or two, that tells you something about how they will handle the next one.

If your host is slow

Shared servers are attractive targets because one break-in can reach many sites. If your host has not patched after a reasonable time:

  • Switch to the newest branch they offer that your site supports, in case they patched that one first.
  • Make sure you have a recent off-server backup of files and database.
  • Plan a move to a host, or a platform, that publishes its security response.

Checking your own account

Even on shared hosting you can look for trouble in your own files: unfamiliar .php files in upload folders, new FTP accounts or email forwarders in the panel, and cron jobs you did not create under Cron Jobs. The compromise checklist has the full list.

Platform-specific next steps

Shared hosting often means WordPress or Joomla; see the WordPress guide and the Joomla guide for the in-app checks.

Move your site to WeInc

On shared hosting you already depend on someone else to patch PHP. A hosted builder makes that someone's whole job keeping your site running. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

More in Blog

Alternatives mentioned in this article

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.

Product

Who It's For

Features

Resources

Company

View Sitemap