Web server and SAPI guides
Nginx and Apache are not the vulnerable component. These guides show how to find the PHP runtime behind each server and what to restart after a fix.
ApacheApache mod_php is the highest-risk PHP2Shell setupWhy PHP ranks mod_php highest, how to confirm it is loaded, and what to restart after the patch.ApacheApache serves PHP in more than one waySeparate mod_php, proxy_fcgi, and CGI on Apache before you choose a PHP2Shell restart.CaddyCaddy and PHP-FPM: patch the upstream FastCGI appCaddy's php_fastcgi directive selects a PHP-FPM socket. The PHP2Shell fix is that FPM build.FrankenPHPFrankenPHP is called out in the PHP advisoryPHP's source analysis treats FrankenPHP as likely susceptible to application-independent attacks for CVE-2026-109618. Update the FrankenPHP build.LiteSpeedLiteSpeed LSAPI and PHP2ShellPHP models LSAPI on FPM for these CVEs. Patch the LiteSpeed PHP build, which is often not the distro package.NginxNginx is not the vulnerable componentHow Nginx hands a request to PHP, and which PHP-FPM binary you have to patch for PHP2Shell.LiteSpeedOpenLiteSpeed PHP handlers need their own build checkedOpenLiteSpeed uses external PHP apps. Identify lsphp and patch that binary, not only the web server package.SAPIphp-cgi is in scope for PHP2ShellPHP lists php-cgi among web SAPIs that need the update. Find who launches it before you restart the wrong service.ApachePHP2Shell when Apache proxies to PHP-FPMFind the FPM pool behind Apache and patch that pool. Restarting only Apache can leave the vulnerable workers running.NginxRemediate PHP2Shell for Nginx with PHP-FPMMap each Nginx vhost to its PHP-FPM pool, patch that build, and restart the workers.ApacheWhat proxy_fcgi changes for PHP2Shellproxy_fcgi selects a backend. The backend's PHP build is what you patch and restart.