LiteSpeed (LSAPI) and PHP2Shell: Patching lsphp

As of 23 October 2026, LiteSpeed servers need the same PHP2Shell fix as every other PHP setup: a patched PHP build, here usually the lsphp package for 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a patched control panel build. Then comes the step that catches people out. You must restart PHP itself, because restarting LiteSpeed does not restart PHP.

LiteSpeed Web Server (LSWS) and its open-source sibling OpenLiteSpeed talk to PHP through LSAPI, LiteSpeed's own interface. The PHP side of that is a program called lsphp. LiteSpeed's documentation is explicit: "As of LiteSpeed Web Server version 5.3, PHP runs in Detached mode and will not be restarted when LSWS restarts." If you update lsphp and only restart LiteSpeed, the old PHP can keep serving your site.

This guide covers what PHP's advisories say about LSAPI, what LiteSpeed itself has published, where your PHP comes from on each kind of LiteSpeed server, and the documented ways to restart detached PHP.

What PHP's Advisories Say About LSAPI

PHP's announcement on php.net lists LiteSpeed among "all PHP installations serving web requests." The two technical advisories each mention it:

• CVE-2026-109618. The GHSA-w8hw advisory says "LSAPI models FPM, with application-specific exploits being likely but unvalidated."
• CVE-2026-109619. The GHSA-6wmf advisory says "LSAPI can apply special environment INI values early and is a conditional candidate."

"Unvalidated" means nobody has shown a full attack against LSAPI in public yet. It does not mean LSAPI is immune. Patch LiteSpeed servers as urgently as any other. For the FPM comparison, see our PHP-FPM and PHP2Shell guide.

What LiteSpeed Has Published

As of 23 October, LiteSpeed has not published a PHP2Shell advisory or blog post. Its blog's newest post is dated 19 October. Its first-party statement on PHP2Shell is a line in the LSWS changelog:

• LSWS 6.3.7 build 5 (released October 22, 2026): "[Security] Update the admin_php binary for CVE-2026-109618 and CVE-2026-109619." The same build says "[Security] Disable WebAdmin by default. Manual activation is required."
• Build 6, the same day: "Fix an IPv6 regression caused by a disabled WebAdmin Console."
• The same two security items appear in 6.4 RC2 build 3.

The admin_php binary runs LiteSpeed's WebAdmin console. Your website's PHP is lsphp (or ea-php or alt-php on panels), and it updates separately. You need both. The changelog page also gives the commands to check your build, cat lsws/BUILD, and to update LSWS: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7.

If you rely on the WebAdmin console, note that after this update it is off by default and must be turned on manually.

Where Your PHP Comes From on LiteSpeed

Before you update, work out which PHP packages your LiteSpeed server actually uses.

Updating lsphp From LiteSpeed's Repository

LiteSpeed's PHP getting started guide sets up its repository with sudo wget -O - https://repo.litespeed.sh | sudo bash and installs packages named by version, such as lsphp85 and lsphp85-common. To see what you have, LiteSpeed documents sudo dnf search lsphp (RHEL family) and sudo apt-cache search lsphp (Ubuntu and Debian).

The fixed builds were in LiteSpeed's repository on 21 October 2026:

Take a backup first (our backup and recovery guide covers what to keep), then run your normal system update to pull these in. On Ubuntu that is sudo apt update && sudo apt upgrade. Update every lsphp version that serves a site, not just the default one.

End-of-life branches. On 21 October LiteSpeed's repository also gained new builds of lsphp74 (7.4.33-21), lsphp80 (8.0.30-21) and lsphp81 (8.1.34-21). LiteSpeed has not said whether they contain PHP's backported fix. Don't assume they do. Ask LiteSpeed support, or move to 8.2 or newer.

Restart Detached PHP: The Step That Gets Missed

Since LSWS 5.3, PHP runs in detached mode, separate from the web server. LiteSpeed's PHP restart documentation gives these options.

Server-wide

• pkill lsphp. "All PHP workers will be immediately stopped and a new set of workers will restart right away."
• sudo touch /usr/local/lsws/admin/tmp/.lsphp_restart.txt. All detached PHP processes restart, "but not immediately. Instead, they will restart one by one, as soon as the server needs to use each PHP handler."
• The same restart is available from "the Actions page of the LiteSpeed WebAdmin Console, or by using the Restart Detached PHP Processes button in our control panel plugins."

For a security fix, pkill lsphp is the faster choice because every worker is replaced at once.

One account only

To restart PHP for a single user, touch a file in that user's home directory: touch /path/to/user/home/dir/.lsphp_restart.txt. LiteSpeed says the user's PHP "will be restarted when the next request comes in." Touch it again each time you need another restart. Users can also restart from the Advanced page of the LiteSpeed Web Cache Manager cPanel plugin.

OpenLiteSpeed

OpenLiteSpeed's documentation uses two commands together:

sudo touch /usr/local/lsws/admin/tmp/.lsphp_restart.txt
sudo systemctl restart lsws

Note what the lsws restart command does on its own. LiteSpeed's command reference describes it as "gracefully restart web server with zero down time." That covers the web server, not detached PHP. For every other setup, see our guide to restarting PHP workers after a security update.

cPanel, CloudLinux and DirectAdmin on LiteSpeed

cPanel. Because LSWS on cPanel uses ea-php or alt-php, apply cPanel's EasyApache 4 update or CloudLinux's packages first. CloudLinux's instruction is to install the fixed packages, "then restart your PHP services (Apache, PHP-FPM, or LiteSpeed)." On LiteSpeed, that means restarting detached PHP as above.

CloudLinux version numbers. Some CloudLinux builds carry the fix as a backport, so their version can sit below PHP's. CloudLinux says to look for the CVE IDs in the package changelog instead, for example rpm -q --changelog alt-php85-common | grep -E 'CVE-2026-(109618|109619)'.

DirectAdmin. DirectAdmin staff announced updated PHP builds on its forum, triggered with da update and da build php. A later staff post on 22 October says a new build "fixes the patching order on servers that use LiteSpeed web server. Before this fix patches would fail to apply when lsphp mode is used." If you run DirectAdmin with LiteSpeed and built PHP before that fix, run the update and PHP build again, confirm the patch is in place, then restart detached PHP.

On shared hosting, all of this is the host's job. Our PHP2Shell shared hosting guide explains what to check.

Mitigations and Confirming the Fix

If you can't patch today, PHP's interim settings belong in php.ini for your lsphp version, not in ini_set() or .user.ini. The CVE-2026-109619 advisory's warning about LSAPI applying INI values early means per-request PHP settings deserve a check too. Remove any invalid or obsolete ones. Restart detached PHP after any change. The full list is in our PHP2Shell interim mitigations guide.

To confirm the fix:

1. Check the installed lsphp package version against the table above, or the CloudLinux changelog for ea-php and alt-php.
2. Load a temporary phpinfo() page and check the version and build date that the website actually sees. Delete it right after.
3. Make sure detached PHP was restarted after the package update.

Our guide on how to check your PHP version covers each method. If you're unsure whether the site was hit before you patched, see was my site hacked through PHP2Shell. Many LiteSpeed sites run WordPress on managed plans; our managed WordPress hosting guide explains what those plans cover.

Conclusion

As of 23 October 2026, LiteSpeed servers are on PHP's list of affected setups, and LiteSpeed's repository has fixed lsphp builds for 8.2 through 8.5. Update lsphp, or ea-php and alt-php on cPanel, and update LSWS itself for the admin_php fix. Then restart detached PHP with pkill lsphp or the .lsphp_restart.txt file, because a web server restart alone leaves the old PHP running. If you want the patch and the restart done and verified, our emergency PHP patching team can help. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions