Instructions for updating PHP to avoid PHP2Shell

PHP is the server-side processing platform for millions of websites, including WordPress. However, if the server still uses an old version of PHP or has not installed security patches, the website may face the risk of exploiting vulnerabilities, executing unauthorized code and taking control of the system.

Notably, on October 21, 2026, the PHP project released new security updates to fix two serious vulnerabilities that could potentially lead to remote code execution. Therefore, website administrators need to check the PHP version they are using and deploy the patch as soon as possible.

In this article, AnonyViet will show you how to check the PHP version, update PHP on Ubuntu, Debian and DirectAdmin, and check the website after upgrading to limit the risk of errors.

On October 21, 2026, the PHP development team announced updates to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two serious vulnerabilities that could lead to remote code execution (RCE). Systems running PHP that handle web requests need to be tested and updated immediately.

Why is it necessary to update PHP regularly?

PHP is used to process form data, query databases, manage login sessions, and execute source code of web applications. Errors in the PHP processor can directly affect the security of the entire website.

Updating PHP regularly provides three main benefits:

• Fix security holes: Updates may fix bugs that allow attackers to execute code, disrupt services, or exploit data.
• Performance improvements: New versions often have improvements in execution speed, memory management, and data processing.
• Maintain compatibility: Using a supported version of PHP helps your website receive bug fixes for a longer period of time.

According to the PHP project’s policy, each version branch is fully supported for the first two years and continues to receive security fixes for the next two years. After this time, the version will reach the end of its support life and will no longer be officially patched.

What is the latest PHP version today?

As of October 22, 2026, PHP 8.5.12 is the latest stable release. PHP 8.6 is still in beta release, so it is not recommended to use this version for an actual live website.

The above versions are releases announced during the security update on October 21, 2026. Admins should check the official download page to confirm a newer patch before deploying it.

Reference: Download official PHP and List of supported PHP versions.

Check the PHP version in use

Before updating, determine the current PHP version. There is one point to note: the PHP version displayed in Terminal may be different from the version the website is using, especially on servers with multiple PHP versions or using PHP-FPM.

Method 1: Check using SSH

Log in to the server via SSH and run the command:

php -v

The results will display the PHP CLI version, for example PHP 8.3.x or PHP 8.4.x.

To see the path of the PHP program being called, use:

which php
php --ini

These two commands help identify the executable and PHP configuration file of the command line environment. They do not guarantee that the website is using the same version or configuration.

Method 2: Test in WordPress

Log in to the WordPress admin page and access Tools → Site Health → Information → Server. Here, you can see the PHP version WordPress is using.

Method 3: Test with a temporary PHP file

If you need to directly check the web environment, create a file named php-version-check.php in the website directory with the content:

Mở tệp bằng trình duyệt để xem phiên bản PHP thực tế của website. Sau khi kiểm tra, hãy xóa tệp này ngay. Không nên công khai phpinfo() hoặc thông tin cấu hình máy chủ vì chúng có thể tiết lộ dữ liệu hữu ích cho kẻ tấn công.
Cập nhật PHP trên Ubuntu và Debian
Trên Ubuntu và Debian, việc cập nhật PHP phụ thuộc vào nguồn phần mềm mà máy chủ đang sử dụng. Nếu PHP được cài từ kho chính thức của hệ điều hành, bạn có thể cập nhật các gói PHP bằng APT.
Bước 1: Sao lưu trước khi cập nhật
Sao lưu mã nguồn website, cơ sở dữ liệu và các tệp cấu hình PHP. Với website WordPress đang hoạt động, nên thực hiện vào thời điểm ít truy cập và chuẩn bị phương án khôi phục nếu phát sinh lỗi.
Bước 2: Cập nhật danh sách gói và các bản vá
Chạy các lệnh sau với quyền root hoặc thông qua sudo:
sudo apt update
sudo apt upgrade
The apt update command refreshes the software package list. The apt upgrade command installs available updates according to the configured software source.
Note: The above two commands do not automatically guarantee a PHP upgrade to the latest major branch. If a software repository only offers PHP 8.3, the server can continue to use PHP 8.3 but be updated with the latest patch provided by that repository.
Step 3: Check and update PHP packages
List installed PHP packages:
dpkg -l 'php*' | grep '^ii'
Check for available updates:
apt list --upgradable 2>/dev/null | grep -E 'php[0-9.-]|php-'
If the PHP packages are managed via APT and have appropriate updates, run apt upgrade and then check again with php -v.
Step 4: If you want to switch to PHP 8.5
First, confirm the PHP 8.5 version is available in the trusted software repositories for your Linux distribution. Do not add an unknown third-party repository just to install a newer version.
On the system there are available PHP 8.5 packages, you can install the necessary packages according to your needs, for example:
sudo apt install php8.5 php8.5-cli php8.5-common \
php8.5-curl php8.5-mbstring php8.5-xml \
php8.5-mysql php8.5-zip php8.5-gd
The above list is only an example. Package name, availability, and extensions depend on the software distribution and repository. Do not install packages by the above names if the system has not provided them.
If the website uses PHP-FPM, you need to install the corresponding PHP-FPM package, configure the web server to switch to the correct socket or new port, and check the necessary extensions. With Apache using mod_php, the way to switch versions will be different and needs to be done according to the current configuration.
After switching, check your website, error log, and background tasks before stopping the old PHP version.
Update PHP on DirectAdmin
DirectAdmin uses CustomBuild to manage and compile PHP versions. This is suitable for VPS servers using DirectAdmin instead of overriding PHP with APT.
Step 1: Check current PHP configuration
Log in to SSH with an account with administrative rights, then run:
grep -E '^php[1-9]_(release|mode)=' \
/usr/local/directadmin/custombuild/options.conf
The results help identify configured PHP branches and processing modes such as PHP-FPM. If you're running multiple versions of PHP, check out all branches before making changes.
Step 2: Update PHP to the latest patch of the current branch
If you are using PHP 8.5, you can use CustomBuild to rebuild the PHP version according to the current configuration:
cd /usr/local/directadmin/custombuild
./build update
./build php 8.5
With a DirectAdmin installation that supports the da build command interface, you can use:
da build update
da build php 8.5
The build php 8.5 command requires that PHP 8.5 has been configured in CustomBuild. Check the output to confirm the version loaded and built actually includes the required patch. Do not assume that recompiling always means having the latest source code.
Step 3: Upgrade the PHP branch to 8.5 if necessary
If the server is using PHP 8.3 or 8.4 and wants to switch to PHP 8.5, it is necessary to first evaluate the compatibility of the website, theme, plugins and other PHP applications.
After backing up and checking compatibility, PHP 8.5 can be configured as the main version with the command:
cd /usr/local/directadmin/custombuild
./build set php1_release 8.5
./build php
./build rewrite_confs
Or use the syntax:
da build set php1_release 8.5
da build php
da build rewrite_confs
Warning: Changing php1_release may affect many websites that are using the default PHP version. On a multi-site server, check the PHP Selector, php2_release branches and above, and the individual configuration of each domain. If compatibility has not been confirmed, you should install PHP 8.5 as an additional version and then transfer each website to test.
Official Documentation: Instructions for managing PHP on DirectAdmin.
Update PHP on the server using Apache
Apache can run PHP in many different ways, such as PHP-FPM or mod_php. How to update depends on the method being used.
If PHP is managed by the operating system's software packages, update the corresponding packages via the package manager. If PHP is managed via DirectAdmin CustomBuild, use CustomBuild instead of installing a separate PHP build that is not integrated with the current configuration.
With PHP-FPM, it is necessary to confirm that the FPM service of the correct version is up and that Apache is passing requests to the correct socket or port. Do not automatically restart a service with a guessed name without determining the actual service name.
Check the status of existing PHP-FPM services with the command:
systemctl list-units --type=service | grep -i php
After updating, check the Apache configuration and error log. Only restart or reload the service that matches the PHP method the server is using.
Check the website after updating PHP
The update is only complete when the website is actually running on the patched version of PHP and important functions still work.
Please check the following:

Home page, article page, search page and login page.
WordPress admin page, editor and content update functionality.
Contact forms, file uploads, email sending, and payment functions where available.
Plugins, themes, cron tasks, REST API, and external integrations.
PHP, PHP-FPM, and Apache error logs to detect syntax or compatibility errors.

Run php -v over SSH to test the PHP CLI, and also check the PHP version in WordPress or via a temporary web test that has been protected and deleted after use.
Measures to enhance PHP security
Updating PHP is an important step but does not replace all server security measures. Administrators should perform the following additional tasks:

Update WordPress, themes, and plugins to versions supported by the developer.
Delete plugins, themes and source code that are no longer in use.
Limit file write and execute permissions according to the principle of minimum.
Do not make public files that contain configuration information, database connection information, or diagnostic data.
Use HTTPS, multi-layer authentication for admin accounts, and regular backups.
Check running PHP processes and system logs when unusual activity is detected.
Evaluate the disable_functions configuration appropriately for the application, instead of arbitrarily disabling functions that the website needs to use.

On DirectAdmin, administrators can refer to CustomBuild’s secure_php option to apply some PHP security settings. However, disabling PHP functions cannot replace installing security patches.
References: Enhance PHP security on DirectAdmin.
Conclude
Maintaining PHP in a supported version and fully installing security patches is an important requirement for all PHP websites, especially WordPress websites running on VPS.
At the time of writing, PHP 8.5.12 is the latest stable version. Admins should check the installation source, confirm the website’s actual PHP version, and deploy the appropriate update as soon as possible. With your system up and running, back up data, test compatibility, and check logs after upgrading to minimize the risk of service disruption.