Updating PHP in cPanel, Plesk, and ISPmanager After PHP2Shell

Summary

Control panels install their own PHP builds, and a plain apt upgrade does not affect them. In cPanel, the update goes through EasyApache 4; in Plesk, through the component installer; in ISPmanager, through the PHP section. Restarting the handlers after the update is mandatory.

cPanel and WHM

PHP builds in cPanel are kept separate from system packages, in the /opt/cpanel directory. To update:

/usr/local/cpanel/scripts/upcp --force
/scripts/restartsrv_httpd
/scripts/restartsrv_cpanel_php_fpm

To check the versions of all installed builds:

ls /opt/cpanel | grep ea-php
rpm -q --changelog ea-php83-php-cli | grep -m1 CVE-2026-109618

If a site runs on a PHP version that is no longer supported (7.4, 8.0, 8.1), no update will be released for it. Move the site to a supported branch.

Plesk

Plesk updates PHP through its own installer:

plesk installer update
plesk bin php_handler --list
plesk bin service --restart-all

The handler list shows all PHP versions and their status. Update every version that sites use.

ISPmanager

In the panel, the update is done under "Server settings → PHP", which shows all installed versions and the available updates. From the command line:

ispmgr-ctl php list
dnf update 'php*' || apt install --only-upgrade 'php*'
systemctl restart 'php*-fpm'

General rule for control panels

A server with a control panel almost always has several PHP versions installed, one for each group of sites. The vulnerability is closed only in the version you updated. Go through the list of versions and confirm that every one in use has been updated.

for v in /opt/cpanel/ea-php*/root/usr/bin/php; do echo -n "$v: "; $v -v | head -1; done

What to check after the update

The sites open and there are no 500 errors.
The package changelog of every version in use contains the CVE numbers.
The PHP-FPM processes were restarted: ps -eo lstart,cmd | grep php-fpm | head shows their start time.

Frequently asked questions

Does cPanel or Plesk update PHP automatically?

cPanel and Plesk can install security updates automatically if this is enabled in the settings. Check that automatic updates are enabled and that they actually ran. The date of the last run is visible in the interface.

Will a PHP security update break customer sites?

An update within the same branch (for example, 8.3.x) is code-compatible. The risk comes with moving between branches, which you should plan separately.

What should I do with sites running PHP 7.4?

Unsupported branches have no fixes and will not get any. The only way to close the vulnerability is to move the site to 8.2 or newer.