In short: On servers with CloudLinux, websites often run not on the standard PHP but on alt-php, separate packages per PHP version that customers choose via the PHP Selector. Against PHP2Shell, the server operator must update every installed alt-php version individually and restart all PHP processes. As a hosting customer, find out which version your account uses and have its patch status confirmed in writing.
Why CloudLinux is a question of its own with PHP2Shell
Many shared hosting providers use CloudLinux, a Linux operating system that separates thousands of customer accounts on one server from each other. For website operators this is usually invisible. It becomes visible only when a vulnerability appears in the PHP interpreter itself, as with PHP2Shell and CVE-2026-109618 and CVE-2026-109619.
The reason: on such servers there are often several PHP sources side by side. Besides the operating system's PHP and, with cPanel, the ea-php packages, there are the alt-php packages from CloudLinux. Each source has its own package status. That one of them is patched says nothing about the others.
For agencies and companies with several accounts at the same hoster, a second point applies: each website may use a different version because somebody switched it in the customer area years ago. A single inquiry about "the PHP" of the hoster therefore falls short. A list of all domains with the version chosen for each is more useful.
What alt-php and the PHP Selector are
According to the CloudLinux documentation, the PHP Selector provides alternative PHP versions, the alt-php packages. They are located under /opt/alt/phpXX/, for example /opt/alt/php83/ for PHP 8.3, each with its own php.ini. The documentation lists versions from 5.1 to 8.5, depending on the server's CloudLinux version.
Customers choose their version themselves, in cPanel usually via "Select PHP Version". Technically this requires CageFS, a kind of sealed-off file system per account. According to the documentation, the Selector works with suPHP, mod_fcgid, CGI and LiteSpeed; Apache with mod_php does not support CageFS.
| Term | What it means for you |
|---|---|
| CloudLinux | The hoster's operating system, separates customer accounts |
| CageFS | Own, sealed-off file system per account |
| alt-php | PHP packages from CloudLinux, one per version |
| PHP Selector | Choice of the alt-php version and individual options in the customer area |
CloudLinux alt-php and PHP2Shell: what is proven and what remains open
Proven: fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 8.1 and older, the PHP project no longer provides official updates, only minimal source backports for 7.4, 8.0 and 8.1. According to the trade press, nearly all versions up to PHP 5.4 are affected.
What remains open in the sources available to us is for which alt-php versions CloudLinux already ships patched packages. Especially for old branches such as 5.6 or 7.4, which the Selector continues to offer, only the provider's statement therefore counts. Backports may have been applied without the displayed version number changing.
One special case concerns cPanel servers with commercial long-term support: according to the cPanel documentation, TuxCare, a CloudLinux brand, ships patched packages for expired PHP versions as alt-php. Anyone switched there from ea-php74 to alt-php74 depends on this route. More in the article Long-term support for old PHP versions.
Questions you should put to your hoster now
As a customer, you cannot patch alt-php yourself. But you can ask the right questions and document the answers. A ready-made template is provided by the guide Asking your hoster for the patch status.
- Does my account run with alt-php, ea-php or the operating system's PHP, and with exactly which version?
- Is exactly this package patched against CVE-2026-109618 and CVE-2026-109619, and since when?
- Were all PHP processes restarted afterward, including lsphp and php-cgi processes?
- Are the interim values from php.net set centrally, in particular
session.upload_progress.enabled=0? - Which alt-php versions are no longer patched, and by when must I switch?
In parallel, check which version your account actually uses. If you have SSH access, php -v shows the command line's version, which can differ from the website's. The display in the PHP Selector for the domain concerned is more reliable.
If the hoster answers that your chosen version is no longer patched, switching to a supported branch is the clean way. Beforehand, check in your CMS's or shop's system requirements which PHP versions the vendor approves, and test the change on a copy of the website if possible. Switching in the Selector is quickly done; an error in the shop on Monday morning is not.
PHP options in the Selector: caution with the interim values
The PHP Selector allows customers to change individual php.ini values themselves, often including memory_limit. Which values are released is determined by the operator, according to the documentation, in the file /etc/cl.selector/php.conf. Global values for all alt-php versions are in /etc/cl.selector/global_php.ini.
This matters for PHP2Shell. As an interim measure, php.net recommends setting memory_limit=-1 so that applications cannot override the value, and not setting session.upload_progress.enabled=0 via ini_set() or .user.ini. A value that every account can freely change does not meet this condition. Background is at Immediate measures without a patch.
For server operators, a short checklist follows from this. The commands only read:
# Which PHP versions does the Selector offer, which is the default?
selectorctl --summary
# Installed alt-php packages and their status
rpm -qa 'alt-php*' | sort
# Are the CVE numbers in a package's changelog? (package name as an example)
rpm -q --changelog alt-php83 | grep -E "CVE-2026-10961[89]"
# Running PHP processes with start time, to prove the restart
ps -eo pid,lstart,cmd | grep -E '[l]sphp|[p]hp-cgi|[p]hp-fpm'
According to the CloudLinux documentation, updating is done with yum groupupdate alt-php. Afterward, all PHP processes must restart, otherwise the old code keeps running in memory. Interim values that must not be overridden belong in the global configuration and not in the list of customer options. How ea-php and alt-php relate to each other on cPanel servers is described in cPanel and WHM: securing PHP.
A patch does not remove malware that was injected beforehand. If your account ran a vulnerable version between 17 and 21 October, it is worth looking at new PHP files and the access logs from 20 October onward.
How does PHP SOS help?
- Clarify the status: We determine which PHP source and version each of your websites runs on, and draft the inquiry to the hoster.
- Assess the answer: We check the hoster's confirmation for gaps, such as missing details on the restart or on old alt-php branches.
- Support the switch: If a website runs on a version without a patch, we plan the move and test it beforehand.
- For operators: Through the PHP patch service, we update alt-php, ea-php and system packages, restart all processes and document the status.
Frequently asked questions
How can I tell whether my hoster uses CloudLinux and alt-php?
A typical sign is the "Select PHP Version" function in the cPanel customer area, through which you can switch between many PHP versions yourself. You only know for sure once the hoster confirms it.
Can I update alt-php in my account myself?
No. The alt-php packages sit centrally on the server and are maintained by the operator. You can only choose between the installed versions and should have the patch status of the chosen version confirmed.
Is an old alt-php version such as 7.4 protected against PHP2Shell?
That cannot be said without a statement from the provider. According to the trade press, nearly all versions up to PHP 5.4 are affected, and the PHP project provides no official updates for 8.1 and older. Whether a backport has been applied must be confirmed in writing by the hoster for exactly your version.
May I change memory_limit in the PHP Selector myself?
Technically often yes, if the operator has released the setting. However, php.net recommends as an interim measure setting memory_limit so that applications cannot override the value. Change such values only in agreement with the hoster.