Why the installed version is not enough
A package upgrade replaces files on disk. PHP-FPM masters, Apache with mod_php and LiteSpeed keep the old code in memory until they restart. The server reports the new version from the command line and still serves requests with the old one.
1. Restart every PHP worker
sudo systemctl restart php8.3-fpm # each version you run: php8.2-fpm, php8.4-fpm …
sudo systemctl restart apache2 # mod_php; httpd on RHEL
sudo systemctl restart lsws # LiteSpeed
Several PHP versions side by side are common on panels such as cPanel and Plesk. Restart each one that serves a site.
For containers, the image has to be rebuilt on the fixed tag and every running container replaced. A restart of the old container brings back the old PHP.
2. Ask the web side which version it runs
Put a temporary file in one site's web root:
<?php echo PHP_VERSION, ' ', PHP_SAPI;
Open it in a browser, read the answer, then delete the file. Expect 8.3.36 fpm-fcgi or similar. On a distribution package, the number may stay lower; confirm the fix in the package changelog instead:
apt changelog php8.3-fpm | grep -E 'CVE-2026-10961[89]'
rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961[89]'
3. Keep the useful settings
The PHP project recommends keeping session.upload_progress.enabled = 0 even after patching if you do not use upload progress. It costs nothing on most sites.
4. Look at the logs, with care
Turn on log_errors with error_reporting = E_ALL and read the PHP and web server logs for the days before you patched: crashes of workers, memory errors at request start, unusual uploads.
Clean logs are not proof
The advisories do not report exploitation in the wild. An attack on these flaws can happen before PHP writes anything, though, so a quiet log does not show that nothing happened. If you have real signs of compromise, bring in an incident response firm; we do not do forensics.
Done
You are finished with PHP2Shell when every server and every PHP version that serves a site reports a fixed build from the web side. Write down the date and the versions; clients and auditors ask.
Last reviewed on 22 October 2026.