Virtual Private Server

How do I fix PHP2Shell vulnerability ?

By Rubi

PHP2Shell is the vulnerability’s name. To fix it, update PHP for your websites and HestiaCP’s separate PHP runtime.

PHP’s patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or newer. Older branches may receive vendor backports, so their complete package revision matters. php.net

Run these commands over SSH as root, after taking a server snapshot or current backup.

1. Refresh packages and review available upgrades

apt update
apt list --upgradable
apt-mark showhold

If apt update reports repository errors, resolve those first.

2. Install the updates

apt upgrade

Review the proposed changes before answering Y. This updates installed PHP packages and Hestia packages when updates are available; it normally keeps each website on its existing PHP branch.

Hestia maintainers confirmed that its PHP repositories provide backported fixes down to PHP 5.6, and that updated hestia-php packages were released for Ubuntu 22.04+ and Debian 11+. Availability still depends on your server’s OS and configured repositories. GitHub

3. Restart PHP workers and the panel

This briefly interrupts PHP requests:

systemctl list-units --type=service --state=running --no-legend 'php*-fpm.service' |
while read -r service rest; do
    systemctl restart "$service"
done

if systemctl is-active --quiet apache2; then
    systemctl restart apache2
fi

systemctl restart hestia

4. Check installed versions and failed services

dpkg-query -W -f='${binary:Package}\t${Version}\n' |
grep -E '^(php[0-9]+\.[0-9]+-(common|fpm|cli)|libapache2-mod-php|hestia-php|hestia-nginx)[[:space:]]'

/usr/local/hestia/php/bin/php -v

systemctl --failed

Then test your websites, including login and uploads. php -v alone only checks the default CLI PHP, which may differ from your websites’ PHP-FPM versions.

If the panel still reports an older version, check:

cat /etc/os-release
apt-cache policy hestia-php hestia-nginx

On Ubuntu 20.04, don’t assume these commands patched the panel: the Hestia announcement above specifically lists Ubuntu 22.04 and newer. Package versions and repository status must be checked before declaring it fixed.

click here to remove old PHP versions from your vps.