In short: For admins without a developer background, five basics are enough to run PHP securely: PHP consists of several programs (command line, PHP-FPM, Apache module), each with its own version; settings take effect in levels from php.ini to the application; PHP-FPM distributes requests to workers in pools; an update takes effect only after all processes have been restarted; and logs are the most important clue when something is wrong. Anyone who knows these points can close vulnerabilities such as PHP2Shell quickly and verifiably.
What PHP consists of on a server
PHP is not a single program. On a typical Linux server there are several variants, each connected through a server interface (SAPI):
| Variant | Typical name | Used for |
|---|---|---|
| Command line (CLI) | php, php8.3 |
cron jobs, Composer, maintenance scripts |
| PHP-FPM | php-fpm, php-fpm8.3 |
web requests behind Nginx or Apache |
| Apache module | mod_php, libphp |
web requests directly in the Apache process |
| CGI | php-cgi |
older setups |
Each variant can have a different version and a different php.ini. On many servers, several PHP versions also run in parallel, such as 8.2 and 8.4. With an update, each must be considered individually. How the interfaces work is explained in PHP-FPM explained.
You can find out which variant actually serves your websites from the running processes and the web server configuration:
ps -eo pid,user,lstart,cmd | grep -E "php|httpd|apache2" | grep -v grep
apachectl -M 2>/dev/null | grep -i php # does Apache load a PHP module?
ls /run/php/ 2>/dev/null # FPM sockets, often per version and pool
The column with the start time matters later during the restart: all PHP processes must have been started after the time of the update. If processes run under different users, that points to separate pools, which is good. If a PHP module appears in Apache although all websites are supposed to run via FPM, that indicates a legacy leftover that should be removed. For hosting interfaces such as Plesk or cPanel the same principle applies, except that the interface displays the versions and handlers per website; what actually runs as a process remains decisive.
The most important commands for admins
php -v # version of the command line
php --ini # loaded php.ini and additionally scanned directories
php --ini=diff # from PHP 8.5: deviations from the default
php -m # compiled-in and loaded modules
php --ri session # settings of an extension
php -l datei.php # syntax check without execution
php-fpm8.3 -v # version of the FPM binary (name varies by distribution)
php-fpm8.3 -t # test the FPM configuration without restarting
systemctl status php8.3-fpm
Two notes from the manual: php -l finds syntax errors but not errors that only occur during execution. And php -i calls phpinfo(); the output does not belong in public files in the web directory.
How PHP settings take effect
A setting can be made in several places. Who may change what is governed by the change mode of each directive:
- php.ini and conf.d: base configuration per variant, read at startup.
- FPM pool:
php_valueandphp_admin_valueper pool. According to the manual, the application cannot override values set withphp_admin_valueviaini_set(). - Directory level:
.user.iniwith FPM or.htaccesswith mod_php, only for directives in modeINI_PERDIRorINI_ALL. - Application:
ini_set()at runtime, only for directives in modeINI_ALL.
An example: memory_limit has the mode INI_ALL, so it can be changed by the application. post_max_size has INI_PERDIR and cannot be changed via ini_set(). That is why php.net, in the PHP2Shell interim measures, requires values to be set so that applications cannot override them. Details on the levels are explained in The php.ini explained.
PHP-FPM pools in brief
A pool is a group of workers with its own user, its own socket and its own settings. The most important directives according to the manual:
[shop]
user = shop
group = shop
listen = /run/php/shop.sock
pm = dynamic ; static, dynamic or ondemand
pm.max_children = 20 ; at most 20 simultaneous requests
pm.max_requests = 500 ; renew a worker after 500 requests
request_slowlog_timeout = 5s
slowlog = /var/log/php-fpm/shop-slow.log
php_admin_value[error_log] = /var/log/php-fpm/shop-error.log
php_admin_flag[log_errors] = on
A separate pool per website with its own user separates websites from one another. security.limit_extensions defaults to .php .phar and prevents FPM from executing file extensions other than PHP. clear_env is switched on by default and keeps environment variables away from the worker.
Logs: where admins should look
PHP writes errors to the destination set with error_log, PHP-FPM additionally to its own log and, for slow requests, to the slow log with a backtrace. In addition there are the web server's access and error logs. Make sure that display_errors is switched off in production and log_errors is switched on: errors belong in the log, not on the web page. Logs should also be rotated and retained for a defined period so that they are still there in an emergency. After PHP2Shell, the trade press recommends keeping server logs from 20 October 2026 onwards. A strong warning sign is a PHP-FPM or web server process that starts a shell; how to recognise this is described under Warning sign: the web server starts a shell.
Checklist for admins after PHP2Shell
- List all PHP variants and versions on the server, including unused ones.
- Check the package state; for distribution backports, search the changelog for CVE-2026-109618 and CVE-2026-109619.
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the confirmed backport.
- Restart PHP-FPM, Apache and LiteSpeed and check the processes' start times.
- Cross-check with
php -r 'var_dump(ini_get("memory_hard_limit_percent"));'; according to the manual,bool(false)means an affected version. - Secure the logs and check them for anomalies.
How to demonstrate version and patch level reliably is described in Checking the PHP version and patch level properly.
How does PHP SOS help?
In the security maintenance contract, we take over basic PHP care together with your team:
- Inventory: all PHP variants, versions, pools and configuration locations per server.
- Configuration: security-relevant values set with
php_admin_value, pools separated per website. - Updates: installation, restart, verification and documentation with every security release.
- Passing on knowledge: We explain to your admins what we changed and why.
Frequently asked questions
Why does php -v show a different version from the website?
The command line, PHP-FPM and the Apache module are separate programs with their own version and their own php.ini. php -v shows only the command line. For the website, what counts is the version of the binary that actually handles requests.
Which php.ini applies on my server?
php --ini shows this for the command line. For PHP-FPM there is usually a separate php.ini and additional pool files. Since PHP 8.5, php --ini=diff shows which values deviate from the default.
What is the difference between php_value and php_admin_value?
Both set values in an FPM pool. According to the manual, the application cannot override values set with php_admin_value using ini_set(). For security-relevant settings, php_admin_value is therefore the right choice.
Is an update without a restart enough?
No. Running PHP processes keep the old code in memory. After an update, PHP-FPM, Apache with mod_php or LiteSpeed must be restarted, otherwise the vulnerable version keeps running.