Products and stacks · Hosting platforms and server managers

PHP2Shell in Bluehost: is it affected and how to fix it

Quick verdict

Affected; a fix exists for some versions or components only.

Vendor status: Partly fixed
PHP: patched builds deploying · cPanel 8.2–8.5 + 7.4–8.1 backports · CloudLinux/TuxCare backports 5.2–8.5 · Plesk · VPS/dedicated: package update
Last checked: 2026-10-22

Bluehost's status announcement “PHP Updates” (posted 21 October) says in its latest update, 22 October 10:00 US Eastern (14:00 UTC), that its teams have made significant progress deploying patched PHP builds across its hosting infrastructure. It now lists the patched builds: on cPanel EasyApache 4, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 plus vendor backports 8.1.34-5, 8.0.30-12 and 7.4.33-19; on CloudLinux EasyApache 4 for CentOS 7 / CloudLinux 7, backported builds for every branch from 5.2 to 8.3 (for example ea-php83 8.3.35-2.el7.cloudlinux.2 and ea-php74 7.4.33-18.el7.cloudlinux.13); CloudLinux/TuxCare alt-php ELS builds for 5.2 to 8.5 (for example alt-php85 8.5.11-5 and alt-php82 8.2.34-7); Plesk PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 plus Plesk Obsidian 18.0.81 Update 4 / 18.0.80 Update 11 for the panel's own PHP; and distribution packages for AlmaLinux, Rocky Linux, CentOS Stream, Fedora, Ubuntu and Debian. Many backported builds keep an older version number, so compare the full build string. Bluehost says that if the version phpinfo() shows matches or is newer than a listed build, the site is patched and no action is needed; customers who manage their own VPS or dedicated server should run a package update through the control panel, and customers who need to act are being emailed. The previous update (23:00 US Eastern on 21 October) said the majority of servers were patched, with mitigations kept in place that may limit upload sizes. No completion time is given.

How to check the PHP version Bluehost uses

Run the command for your setup. A version at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in its branch is fixed; older branches are fixed only by a vendor build that says so.

php -v

The command-line php can differ from the PHP that serves the site. To be sure, check the web SAPI (a temporary phpinfo() page behind authentication, or the panel's PHP settings) and remove it afterwards. Our version checker compares a version number for you.

🔎 Got a version number? Paste it into the PHP2Shell checker →

How to fix PHP2Shell in Bluehost

Find out where the PHP that runs this application comes from: your distribution, a third-party repository (Ondřej Surý, Remi), a hosting panel, a Docker image or your host.
Update that PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a vendor build with the backported fix, and restart every PHP worker.
On shared or managed hosting you cannot patch PHP yourself: ask the host whether the fixed PHP is deployed, and switch the site to a fixed version in the panel.
If the site still runs PHP 8.1 or older, move it to a supported branch; PHP published only source patches for 7.4, 8.0 and 8.1.

Prefer to let an AI agent do the checks? Check if you are affected · Fix with an AI agent

If you cannot patch yet

Set session.upload_progress.enabled = 0 where applications cannot override it (php.ini, php_admin_value in the FPM pool or Apache config), and restart PHP.
On PHP 8.5, set fatal_error_backtraces = 0.
PHP's interim advice also covers memory_limit and a low post_max_size; follow the remediation page exactly, because these settings only reduce some paths.
Restrict access (VPN, IP allowlist) or take the service offline if it runs PHP 8.1 or older with no vendor backport. WAF rules help but are not a fix.

FAQ

Is Bluehost affected by PHP2Shell?

Affected; a fix exists for some versions or components only. Bluehost's status announcement “PHP Updates” (posted 21 October) says in its latest update, 22 October 10:00 US Eastern (14:00 UTC), that its teams have made significant progress deploying patched PHP builds across its hosting infrastructure. It now lists the patched builds: on cPanel EasyApache 4, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 plus vendor backports 8.1.34-5, 8.0.30-12 and 7.4.33-19; on CloudLinux EasyApache 4 for CentOS 7 / CloudLinux 7, backported builds for every branch from 5.2 to 8.3 (for example ea-php83 8.3.35-2.el7.cloudlinux.2 and ea-php74 7.4.33-18.el7.cloudlinux.13); CloudLinux/TuxCare alt-php ELS builds for 5.2 to 8.5 (for example alt-php85 8.5.11-5 and alt-php82 8.2.34-7); Plesk PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 plus Plesk Obsidian 18.0.81 Update 4 / 18.0.80 Update 11 for the panel's own PHP; and distribution packages for AlmaLinux, Rocky Linux, CentOS Stream, Fedora, Ubuntu and Debian. Many backported builds keep an older version number, so compare the full build string. Bluehost says that if the version phpinfo() shows matches or is newer than a listed build, the site is patched and no action is needed; customers who manage their own VPS or dedicated server should run a package update through the control panel, and customers who need to act are being emailed. The previous update (23:00 US Eastern on 21 October) said the majority of servers were patched, with mitigations kept in place that may limit upload sizes. No completion time is given.

Does updating Bluehost itself fix CVE-2026-109618 and CVE-2026-109619?

Only if the update contains fixed PHP. PHP2Shell is a flaw in the PHP interpreter, so what matters is the PHP that Bluehost runs on. Check the version after updating.

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released 21 October 2026. PHP 8.1 and older get no release from the PHP project; only vendor builds with a backport (or a self-built source patch for 7.4, 8.0 and 8.1) fix them.

What if Bluehost has no fix yet?

Keep its PHP-based web interface off the internet (VPN or IP allowlist), apply PHP's interim settings such as disabling session upload progress, and install the vendor update as soon as it ships. Interim settings reduce risk but are not a fix.

← All products that bundle PHP

Sources

Outbound links leave this site. We do not host exploit code.

Unofficial summary of public sources. This site is not affiliated with the vendor or the PHP project and hosts no exploit code.