# Server and hosting: patching PHP properly

> Securing PHP2Shell on Plesk, cPanel, shared hosting, root servers, Apache mod_php, PHP-FPM, LiteSpeed, FrankenPHP and Kubernetes.

Source: https://phpsos.de/en/server/  
As of: 25/10/2026  
Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6

Plesk, cPanel, Apache, Nginx, LiteSpeed, containers: who is responsible, how do you check the real patch level, and how do you restart all workers?

- [Plesk Server: Checking and Patching PHP Versions](https://phpsos.de/en/server/plesk/): Plesk servers often run several PHP versions side by side. Here is how to check every handler, apply the PHP update and restart all workers.
- [cPanel and WHM: Securing PHP](https://phpsos.de/en/server/cpanel/): cPanel manages PHP through EasyApache 4 with separate packages per version. Here is how to check the state, restart all processes and set interim values correctly.
- [Shared Hosting: What the Host Does and What You Need to Do](https://phpsos.de/en/server/shared-hosting/): With shared hosting, the host patches PHP. Your job is to get the confirmation, choose the PHP version and check your website for traces.
- [Securing Your Own Root Server and vServer](https://phpsos.de/en/server/root-server-vserver/): With your own root server or vServer, all responsibility lies with you. Here is how to check and patch PHP, restart all processes and harden the system.
- [Managed Server: Clarifying Responsibility](https://phpsos.de/en/server/managed-server/): A managed server takes a lot off your hands, but not everything. Here is how to clarify who patches PHP, who restarts and who is responsible for application, data and reports.
- [Securing Apache with mod_php](https://phpsos.de/en/server/apache-mod-php/): The PHP team rates the risk highest for mod_php. Here is how to identify the operating mode, patch correctly, restart Apache and plan the move to PHP-FPM.
- [Securing Nginx with PHP-FPM](https://phpsos.de/en/server/nginx-php-fpm/): With Nginx and PHP-FPM, security lies in pools, permissions and a clean restart. Here is how to patch after PHP2Shell and harden Nginx and PHP-FPM for good.
- [LiteSpeed and LSAPI: Updating PHP](https://phpsos.de/en/server/litespeed/): LiteSpeed uses its own lsphp packages and keeps PHP processes in memory for a long time. Here is how to apply the PHP update and make sure all processes really restart.
- [Securing FrankenPHP](https://phpsos.de/en/server/frankenphp/): FrankenPHP ships PHP inside its own program. A distribution update is therefore not enough: the binary or image must be rebuilt and all workers restarted.
- [php-cgi: Legacy With Risk](https://phpsos.de/en/server/php-cgi/): php-cgi often hides unnoticed in old setups, panels and on Windows. Here is how to find it, patch it after PHP2Shell and plan the switch to PHP-FPM.
- [Patching PHP in Kubernetes](https://phpsos.de/en/server/kubernetes/): In a cluster, PHP lives in images. Here is how to find all vulnerable pods, rebuild images with fixed PHP, roll them out and prove the state of each workload.
- [Securing PHP on Windows and IIS](https://phpsos.de/en/server/windows-iis-php/): Under IIS, PHP usually runs as php-cgi.exe via FastCGI. Here is how to find all installations, swap PHP safely, recycle the application pools and check the result.