宝塔面板

Which 宝塔 PHP version fixes PHP2Shell?

This page follows 宝塔’s own notice, updated on 22 October 2026, not a forum thread. The Simplified Chinese guide with the panel’s UI labels is at the same path under /zh/. The facts match. Node.js is mentioned in that notice and is out of scope here.

Last updated 2026-10-22

Every row is what the 宝塔 notice states. Upstream PHP releases are only the 8.2–8.5 line.

Item	What 宝塔’s notice says	Source
Synced on Linux and Windows	PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, described as containing both fixes	宝塔 notice
Linux packages for old branches	7.4.34, 8.0.31, and 8.1.35. 宝塔 says these are its Linux builds, include both fixes, and install from the software store. They are not PHP project release numbers.	宝塔 notice
Windows, PHP 8.1 and older	No equivalent of those three packages. Interim setting only: session.upload_progress.enabled=0 in the php.ini that is actually loaded, then restart that PHP service. Not a complete fix.	宝塔 notice
Click path	登录 → 软件商店 → 已安装 → 更新软件列表 / 支付状态 → 更新 on the PHP version in use → confirm the version and the site	宝塔 notice
Severity, as restated	CVSS v4.0 9.2 for each CVE. The score originates with the PHP security team; 宝塔 repeats it.	宝塔 notice; oss-security
Upstream releases	8.5.12, 8.4.27, 8.3.36, and 8.2.35 on 21 October 2026. Updating is the only complete fix PHP describes.	php.net

Upgrade in the panel

Back up the site and the panel configuration before you change PHP.
Log in to 宝塔. Open 软件商店 (Software store) and the 已安装 (Installed) list.
Click 更新软件列表 / 支付状态 (Update software list / payment status) at the top right so the list is current.
Find the PHP version the site is actually using and click 更新 (Update). Confirm the version number against the table above.
Reload a real page and the features you depend on. If several PHP versions are installed, repeat the check for each one that still has a site.

Windows PHP 8.1 and older

The notice is explicit that the three old package numbers are Linux. For Windows PHP 8.1 and older it only offers an interim change in the php.ini that the service actually loads:

Quoted from the 宝塔 notice as an incomplete bridge for one confirmed path of CVE-2026-109619. It does not fix both CVEs.

session.upload_progress.enabled = 0

Save, restart that PHP service, and repeat for every old PHP on the machine. 宝塔 says to move these Windows installs onto a supported branch and the matching fixed release. The same notice points at PHP’s other incomplete limits, including post_max_size (8M without uploads, 32M with uploads) and a warning that memory_limit=-1 is not for ordinary use without a cgroup or container limit. Do not replace that limit with RLIMIT_AS or RLIMIT_DATA. Those details, and PHP’s own wording, are on the remediation page.

What this page does not cover

The same 宝塔 notice also lists Node.js updates (22.23.4, 24.22.1, and 26.12.1 in the notice’s table). This briefing does not cover Node.js. It also does not copy exploit steps or log signatures. Branch-by-branch upstream answers are on the PHP 8.5, 8.4, 8.3, 8.2, and PHP 5 through 8.1 pages.

Does the 宝塔 panel already have the PHP 8.2–8.5 fixes?

The notice says Linux and Windows panels have synced 8.2.35, 8.3.36, 8.4.27, and 8.5.12, and that those builds include both fixes. You still have to install the update for each PHP version the sites actually use, then confirm the version and the site.

Is 宝塔’s PHP 8.0.31 an official PHP release?

No. The notice says PHP did not publish installable packages for 7.4, 8.0, and 8.1, and that 7.4.34, 8.0.31, and 8.1.35 are 宝塔 packages for the Linux panel. Do not read those numbers as php.net releases. The version checker on this site cannot see them.

What about Windows PHP 8.1 and older?

The notice says those Windows builds do not get the three Linux package numbers. The interim step it gives is session.upload_progress.enabled=0 in the php.ini that PHP actually loads, then a restart of that PHP service. 宝塔 says this only eases a confirmed path for CVE-2026-109619 and is not a complete fix for both CVEs.

Where do I click?

Log in, open 软件商店, choose 已安装, click 更新软件列表 / 支付状态 at the top right, then 更新 on the PHP version the site is using. Back up first. Repeat for every installed PHP version. The labels are quoted from the Chinese notice.

Sources

Outbound links leave this site. We do not host exploit code.

PHP 与 Node.js 紧急安全更新公告（更新于 2026-10-22） — 宝塔面板 (BT Panel)
News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption — oss-security (Jakub Zelenka, PHP security team)