Introduction

CVE-2026-109618 and CVE-2026-109619, collectively called "PHP2Shell" did have a large global impact and many sites and platforms shut down to prevent from harm and patched quickly.

CVE ID present in the installed package changelog
and
phpinfo() through the web server
confirms the expected SAPI/version.

The patch is backported by CloudLinux, so the PHP version often remains
e.g. 8.3.35 or 8.4.26 rather than becoming 8.3.36/8.4.27.

Therefore, php -v or the cPanel/DirectAdmin PHP selector cannot prove patch status

TESTs

Test in Web Browser

Create phpcheck.php with code

header('Content-Type: text/plain');
echo 'SAPI: ' . php_sapi_name() . "\n";
echo 'Version: ' . PHP_VERSION . "\n";
echo 'Binary: ' . PHP_BINARY . "\n";
echo 'Loaded config: ' . php_ini_loaded_file() . "\n";

Browse
https://example.com/phpcheck.php

Test from CLI

curl -s https://example.com/phpcheck.php

or

e.g.
/opt/alt/php84/usr/bin/lsphp -v 2>/dev/null || php -v
/opt/alt/php85/usr/bin/lsphp -v 2>/dev/null || php -v
will show you build dates at patch day or later.

Patched Version Overview

alt-php      Fixed build
alt-php52    5.2.17-242
alt-php53    5.3.29-220
alt-php54    5.4.45-203
alt-php55    5.5.38-183
alt-php56    5.6.40-147
alt-php70    7.0.33-148
alt-php71    7.1.33-114
alt-php72    7.2.34-97
alt-php73    7.3.33-82
alt-php74    7.4.33-81
alt-php80    8.0.30-69
alt-php81    8.1.34-39
alt-php82    8.2.34-7 or 8.2.35-1
alt-php83    8.3.35-6 or 8.3.36-1
alt-php84    8.4.26-5 or 8.4.27-1
alt-php85    8.5.11-5 or 8.5.12-1

If you do not understand this KB article, then you may want to ask your web developer.