The php remedy

By now you’ve heard about the October 2026 PHP CVEs (PHP2Shell).

What most people aren’t covering is what to actually do when you’re renting a VPS and only have cPanel + root WHM access.
This is a high-level practical guide to get you started — not exhaustive.

Immediate steps

1. Note the current PHP version of every site.
2. Set every site to PHP 8.2.35 or newer in MultiPHP Manager.
(UPDATED) 3. For every PHP version that is installed:
- Go to WHM → Software → MultiPHP INI Editor → Editor Mode
- Select the PHP version
- Scroll to the bottom and add:
session.upload_progress.enabled = Off
- Save.
4. Restart services in WHM:
- Restart Services → PHP-FPM Service for Apache
- Restart Services → HTTP Server (Apache)

This is the best minimal stopgap while you temporarily move a site back to an older PHP version to upgrade its software.

Before you temporarily downgrade any site

- Gather everything you need for the upgrade (module zips, software packages, etc.).
- Grab the root error_log from October 17 onward (and earlier if you want a baseline) from File Manager and have an AI review it for PHP2Shell indicators.
- Download the relevant domain access logs from cPanel → Metrics → Raw Access (October 20 onward is the important window). Zip them and have an AI check those too.
- In File Manager, sort by last modified and look for any new .php files created on or after October 20 that you didn’t put there. New unexpected PHP files are a common sign of compromise.

Upgrading a site
Once you’ve confirmed the site looks clean:

1. Switch the site to the older PHP version.
2. Upgrade the software as quickly as possible.
3. Immediately switch it back to PHP 8.2.35 or newer.

Afterward

Watch for unusual behavior, new users (especially admins), or unexpected file changes. If you see anything suspicious, treat it as a possible incident: change passwords, ban/remove unknown users, and investigate further.

Do not take this lightly. If an attacker gets in quietly, they can later abuse the site’s users or data without you immediately noticing.