What to do about PHP2Shell

I look after sites for clients

The work is mostly an inventory: which PHP each site actually runs, who controls it, and who needs a nudge. Then tell clients before they read about it in the news.

1. List every site and who controls PHP

For each site, note where it's hosted and who can update PHP: you (your own server or VPS), the client's host, or your reseller or agency hosting provider. That decides what happens next.

2. Get the real PHP version for each site

Check the PHP that serves the website. The command-line PHP on a server is often a different version.

• WordPress, by hand: Tools, Site Health, Info, Server shows the web PHP version.
• WP-CLI: careful here. WP-CLI runs on the command-line PHP, so wp eval 'echo PHP_VERSION;' tells you about that, not the website. wp --info shows which PHP binary it uses. For the web PHP, use Site Health or the server checks below.
• Ubuntu and Debian servers: ls /etc/php/*/fpm/pool.d/ shows which PHP-FPM versions have site pools. Check each one with php-fpm8.2 -v, changing the number to match.
• Plesk servers: plesk bin php_handler --list lists every PHP handler and its full version.
• cPanel servers: each EasyApache PHP has its own binary, for example /opt/cpanel/ea-php82/root/usr/bin/php -v.

Then check each version, or compare against the fixed versions table.

3. Decide what comes first

1. Servers you control running an unpatched PHP: patch today. See the server guide.
2. Sites on PHP 8.1 or older: no official fix. Check for a vendor patch, and plan upgrades to 8.2 or newer.
3. Sites on client-owned hosting: send the host this email, or have the client send it.
4. Sites not behind a firewall service: consider Cloudflare's free plan as a stop-gap while patches land.

Once patched, run the compromise checks on anything that was exposed, starting with sites that take payments or hold personal data.

4. Tell your clients

Clients will see headlines about PHP2Shell. A short note from you first builds trust. Edit the status line for each client.

Subject: PHP2Shell security issue: what we're doing about your website

Hi [name],

You may see news this week about PHP2Shell, two serious security flaws in PHP, the software that runs your website.

We've checked [website]. [Choose one: It's already running a fixed version, so it's protected. / We're updating it today and will confirm when it's done. / Your hosting company needs to update it. We've contacted them and will follow up until it's done.]

You don't need to do anything. We'll let you know if that changes.

Thanks,
[your name]