PHP2Shell and WHMCS: What Hosting Companies Need to Do

As of 23 October 2026, WHMCS has not published a PHP2Shell statement that we could find on its blog, documentation or status page, and the research firm Calif lists WHMCS among the PHP applications where it says it confirmed unauthenticated remote code execution. The PHP project fixed both flaws on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The direct answer: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a flaw in PHP, the language WHMCS runs on. It is not a WHMCS bug, and no WHMCS update fixes it. If you run WHMCS on your own server, you protect it by installing a patched PHP build, confirming the ionCube Loader still works, and restarting every PHP process. If you sell hosting, the same job applies to every customer server you manage.

Below: what is known about WHMCS, PHP versions per release, how to check the PHP WHMCS uses, and what to do about its billing data. For background, read what PHP2Shell is and who it affects.

Is WHMCS Affected by PHP2Shell?

WHMCS is exposed through PHP, like every PHP application. PHP's advisory covers "all PHP installations serving web requests."

Two public sources name WHMCS specifically:

• Calif. On its PHP2Shell page, Calif lists WHMCS, with no version number, among 11 apps where it "confirmed pre-auth RCE." Wiz, the other research team, demonstrated attacks only against WordPress, Drupal and Joomla.
• NCSC-NL. The Dutch national cyber security centre's software inventory lists "WHMCS self-hosted application" as Vulnerable for both CVEs. Its note says the product is "Affected when deployed on an affected web-serving PHP runtime" and that "The remediation is the PHP runtime upgrade."

Neither source says attackers have broken into WHMCS installations. As of 23 October 2026, widespread exploitation attempts against PHP are reported, but confirmed successful compromises are not publicly documented.

WHMCS Cloud vs Self-Hosted WHMCS: Who Patches

Who installs the PHP fix depends on where WHMCS runs.

If you are a hosting company, WHMCS is only one PHP install. Customer servers, your own website and any panel that runs PHP need the same fix. cPanel, for example, says its 21 October EasyApache 4 release fixes "ea-php74 through ea-php85," and that cPanel and WHM 138.0.18, 136.0.50 and 134.0.66 include PHP 8.4.27 for cPanel's own interfaces.

PHP Versions by WHMCS Release

WHMCS ties each release to specific PHP branches and ionCube Loader versions. This table uses WHMCS's own system requirements and its support tiers page, read on 23 October 2026.

No WHMCS release lists PHP 8.5. PHP 8.2 reaches end of life on 31 December 2026, the same day WHMCS 9.0 support ends. And WHMCS 8.13 still allows PHP 7.2 to 8.1, branches WHMCS's own 9.0 release notes say "may incur security risks."

For every branch and package name, see our PHP2Shell fixed versions list.

How to Check the PHP Version WHMCS Uses

WHMCS documents a built-in page for this. Its PHP Info documentation says: "You can view this information at Utilities > System > PHP Info." The page shows "PHP options and extensions, the PHP version, server information, and php.ini configuration settings currently in use for the WHMCS Admin Area."

That is the PHP actually serving WHMCS, which can differ from the one you see over SSH. Two cautions:

• Backported builds keep old numbers. Ubuntu, AlmaLinux, CloudLinux and Plesk all ship fixes that can keep an old version string. Check the package changelog or ask whoever built it.
• The command line can differ. watchTowr warns that "The command-line php binary can be a different version from the one PHP-FPM or Apache runs." If any WHMCS tasks call PHP from the command line, check that binary too.

Our guide to checking your PHP version covers php -v and package changelogs.

Steps to Patch PHP Under WHMCS

These steps are for self-hosted WHMCS on a server you or your team control. Commands are examples; replace 8.3 with your PHP version and use your distribution's package names.

1. Take a backup. Back up the WHMCS files, the database and your configuration.php file, and confirm you can restore them. Our backup and recovery guide explains what a usable backup looks like.
2. Find your PHP branch. Open Utilities > System > PHP Info and note the version and the server API (for example FPM/FastCGI or Apache 2.0 Handler).
3. Update PHP within the same branch. Stay on the branch you run now, so 8.3 moves to 8.3.36 or your vendor's patched 8.3 package. On Debian or Ubuntu that is typically sudo apt update then sudo apt upgrade. On cPanel, Plesk or DirectAdmin, use the panel's PHP update.
4. Restart every PHP process. An installed update does nothing until PHP reloads it. Example: sudo systemctl restart php8.3-fpm, or restart Apache if PHP runs as mod_php. If you run several FPM pools, restart each one.
5. Confirm ionCube still loads. Reload Utilities > System > PHP Info and check that the ionCube Loader is listed, then log in to the admin area and the client area.
6. Turn off session upload progress. On 23 October PHP published an informational advisory (CVE-2026-115560) that affects even patched releases. It suggests setting session.upload_progress.enabled=0 in php.ini or the FPM pool "until the next regular bugfix release." Restart PHP after changing it.
7. Check your logs back to 17 October. That is the earliest exploitation attempt any vendor has reported.

If you cannot patch today, see our interim mitigations guide. CISA says systems that cannot be updated, or that run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated." Use a maintenance page or a network restriction: Beazley warns that disabling the PHP handler "can expose application source code and credentials."

WHMCS 8.13 on Old PHP: Patch First, Upgrade Next

If your WHMCS 8.13 install runs on PHP 7.2, 7.3, 7.4 or 8.1, there is no php.net release for you, though "Some distributions and LTS vendors provide backported fixes," as PHP's advisory puts it. Your options, in order:

1. Install a vendor-patched build of your current branch. For example, Ubuntu 22.04 LTS ships a fixed php8.1 package, and cPanel backported the fix to ea-php74, ea-php80 and ea-php81.
2. Then plan the move to PHP 8.2 or 8.3. WHMCS 8.13 already supports both. WHMCS 9.0 and later go further and "requires that you upgrade to PHP 8.2 or higher and install the appropriate version of ionCube Loader for your PHP version."
3. Check encoded add-ons before switching branches. WHMCS's Utilities > System > PHP Version Compatibility report "displays a list of the ionCube-encoded files in your WHMCS installation directory that may not properly decode in certain versions of PHP."

Do a branch change on a test copy, not on the same evening as an emergency patch.

Your Billing Data and Credentials

WHMCS holds client records, invoices and payment gateway settings, and its modules connect to domain registrars and hosting servers. That raises the stakes if a server was compromised.

Wiz describes one PHP2Shell path as remote memory disclosure and says leaked memory "may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself." Beazley advises defenders to "treat secrets held by an affected PHP process as potentially exposed."

If your checks find signs of compromise, such as unexpected PHP files, new admin accounts or PHP processes spawning shells, then:

• Rotate payment gateway API keys and webhook secrets.
• Rotate registrar API credentials and server module passwords or tokens.
• Reset WHMCS admin passwords and review two-factor settings. Our access control and 2FA guide covers this.
• Follow our was my site hacked checklist before restoring anything.

Data breach rules depend on where you and your clients are. This is general information, not legal advice.

What Not to Rely On

• A WHMCS update. Cloudflare puts it plainly: "updating website code or a plugin(s) alone does not fix these vulnerabilities."
• Settings in .htaccess, .user.ini or ini_set(). PHP says not to rely on ini_set() or FPM .user.ini for its mitigations. Per-directory settings that produce warnings before a request starts are one of the code paths PHP lists for CVE-2026-109619.
• Clean logs. PHP's own advisory says the "absence of an error in logs is not proof of safety."

Conclusion

PHP2Shell is not fixed by a WHMCS patch, and WHMCS has announced none. It needs a patched PHP build under WHMCS, a full restart, a check that ionCube still loads and, for WHMCS 8.13 on old PHP, a vendor backport now and a branch upgrade soon. Because WHMCS holds billing and server credentials, treat any sign of compromise as a reason to rotate secrets. If you want a second pair of hands on your billing server or your customer fleet, see our emergency PHP patching service. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions