php-cgi and PHP2Shell: What Older Hosting Setups Need to Do

As of 23 October 2026, PHP lists php-cgi among the setups affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Treat it like any other affected server. Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's patched package, then restart whatever launches php-cgi: the web server, IIS or the hosting service.

php-cgi is the CGI and FastCGI version of the PHP program. CGI is an old, simple way for a web server to hand a request to an outside program. FastCGI is its faster successor, where the PHP processes stay running between requests. You are most likely to meet php-cgi on Windows servers running IIS, on older shared hosting and on some Apache setups that run PHP as a separate process.

The published research says less about php-cgi than about other setups. This page sticks to what the sources support: what PHP says, how to patch on Linux and Windows, how to restart, and how to confirm the fix.

What the Advisories Say About php-cgi

PHP's 21 October announcement on php.net says the flaws affect "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed."

That is the extent of the official detail. The two technical advisories analyze mod_php, FPM, LiteSpeed and FrankenPHP in turn, but give php-cgi no separate analysis or instructions. Bitdefender's exposure table sums it up as "In scope per PHP; no public exploitability analysis."

Read that as "not studied in public yet," not as "safe." (A SAPI is the interface that connects PHP to a web server; php-cgi is one.) The fix is in PHP itself, and PHP tells every web setup to install the same patched build. For how the flaws work at a summary level, see what PHP2Shell is.

Where php-cgi Still Runs

Not sure which applies to you? A temporary phpinfo() page shows a Server API line that names the interface in use. Delete the page right after. Our guide on how to check your PHP version covers phpinfo and the other methods.

Patching php-cgi on Linux

Linux distributions ship php-cgi as part of their PHP packages, and their fixes cover it.

• Ubuntu. Ubuntu's USN-8948-1 lists the cgi package for each release. Examples: php8.5-cgi 8.5.4-0ubuntu1.5 (26.04 LTS), php8.3-cgi 8.3.6-0ubuntu0.24.04.13 (24.04 LTS) and php8.1-cgi 8.1.2-1ubuntu2.28 (22.04 LTS). Ubuntu says "a standard system update will make all the necessary changes": sudo apt update && sudo apt upgrade.
• Debian. Fixed PHP builds include php8.4 8.4.27-1~deb13u1 (trixie) and php8.2 8.2.35-1~deb12u1 (bookworm). The php8.x-cgi package is built from the same source.
• RHEL family and control panels. Update PHP through the distribution or panel, as described in our PHP2Shell fixed versions guide.

As with all distribution builds, the version number stays low because the fix is backported. Ubuntu 24.04's patched php-cgi still reports PHP 8.3.6. Compare the full package version, not just the PHP number.

Debian's own Apache configuration for php-cgi carries a note worth keeping: "as a security measure, it's recommended to enable PHP just in the specific virtual servers or just specific directories." If php-cgi is enabled server-wide on a machine where it isn't needed, this is a good time to narrow it.

Patching php-cgi.exe on Windows and IIS

On Windows, the PHP project publishes its own builds. PHP's announcement notes that "Windows source and binaries are on the same page." The windows.php.net download page lists PHP 8.5.12, with the 8.5.12 x64 Non Thread Safe build dated 2026-Oct-21 13:48:01 UTC. Its releases folder also holds 8.4.27, 8.3.36 and 8.2.35.

Pick the right build. windows.php.net says: "if you want to use PHP as FastCGI with IIS, use the Non-Thread Safe (NTS) builds of PHP." PHP's IIS installation page says the same.

A typical update looks like this:

1. Note the folder IIS uses. Microsoft's documentation says IIS's FastCGI setting points "to the directory and file name of the PHP binaries."
2. Download the fixed NTS build for the same branch, such as 8.3.36 if you run 8.3.
3. Back up the current PHP folder, including php.ini and any extensions you rely on. A full site backup first is wise too; our backup and recovery guide explains what to keep.
4. Install the new build where IIS expects it, or point IIS at the new folder.
5. Restart IIS. Microsoft documents iisreset /restart to stop IIS and start it again.
6. Confirm the version with a temporary phpinfo page, then delete it.

Why restart? IIS keeps php-cgi.exe processes running between requests. Microsoft's FastCGI settings recycle each process after 200 requests by default (instanceMaxRequests), but don't rely on that. Restart so no process from the old build is left.

PHP 8.1 and older on Windows. PHP's backports for 7.4, 8.0 and 8.1 are source code only, with no official Windows binaries. If your Windows site runs one of these, plan an upgrade to a supported branch. Some platforms have taken their own positions. Plesk lists fixed Windows builds only for 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Microsoft says the built-in PHP on Azure App Service for Windows is end-of-life and "No security patch for these runtimes is currently planned." If you can't patch or upgrade, US, UK and EU agencies all advise taking the system offline or isolating it until you can.

Shared Hosting That Runs PHP as CGI

On shared hosting, you usually can't touch php-cgi yourself. The host updates PHP for every account. What you can do:

• Pick a supported PHP branch, 8.2 or newer, in your control panel if the host offers a choice.
• Ask the host to confirm the build that serves your site and that PHP processes were restarted. Our message template for your web host has the exact questions.
• If the host uses CloudLinux packages, check the build date rather than the version. GoDaddy's guidance is that patched packages "have a build date of October 21, 2026 or later."

Which tasks belong to you and which belong to the host depends on the plan. Our shared responsibility model guide lays it out.

Mitigations If You Can't Patch Today

PHP's interim settings apply to php-cgi too, as long as they are set where PHP reads them at startup. That means php.ini or the server configuration, not ini_set() or .user.ini. Restart afterward. The full list, and what each setting can break, is in our PHP2Shell interim mitigations guide. They narrow the known attack paths. They don't fix the flaws.

Conclusion

As of 23 October 2026, php-cgi is on PHP's list of affected setups. There is no published analysis showing it is any safer, so patch it like any other. On Linux, install your distribution's updated php-cgi package. On Windows and IIS, install the fixed NTS build from windows.php.net. Then restart the web server or IIS and confirm the build serving pages. If you're on PHP 8.1 or older, upgrading is the real fix. If your server runs an older setup you'd rather not touch alone, our emergency PHP patching team can patch and verify it. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions