PHP2Shell on Windows and IIS

As of 23 October 2026, PHP's own Windows builds with the PHP2Shell fixes are on windows.php.net: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, dated 21 October. Windows servers are affected like any other. PHP's advisory covers "all PHP installations serving web requests," and on Windows that usually means IIS running php-cgi.exe, or Apache running PHP as a module.

The direct answer: on Windows, nothing updates PHP for you unless a panel or platform manages it. Download the fixed build for your branch, in the right flavor for your web server, put it where your server expects PHP, keep your php.ini, restart IIS or Apache, and confirm the version a page actually reports.

The hard part on Windows is usually finding every copy of PHP. This guide starts there.

Find Every Copy of PHP on the Machine

Windows PHP is usually a folder, not an installed package, and a server can have several. Each one that serves web pages needs the fix.

To find copies, look at what your web server points to. IIS's FastCGI configuration names the full path of the PHP program it runs; Microsoft's documentation says to "set the fullPath attribute to the directory and file name of the PHP binaries." In Apache, the LoadModule line for PHP in httpd.conf names the PHP folder. Also check for older PHP folders left behind by earlier upgrades, and for applications that bring their own PHP.

Choose the Right Build

The windows.php.net download page offers several builds of each release. Pick carefully, because the wrong one won't load or won't work with your server:

• NTS or TS. In PHP's words: "if you want to use PHP as FastCGI with IIS, use the Non-Thread Safe (NTS) builds of PHP, or if you want to use the Apache HTTP Server, use the Thread Safe (TS) builds of PHP."
• Architecture. "It is recommended to use x64 builds of PHP as almost all Windows installations currently support x64." Match what you have now.
• Same branch. Stay on your branch (8.3.x to 8.3.36, for example) for an emergency patch. Changing branches is an upgrade, which needs testing.
• Runtime. The builds "require the Visual C++ Redistributable for Visual Studio 2015-2022 x64 or x86 installed." Current 8.4 and 8.5 builds are VS17; 8.2 and 8.3 are VS16.
• Checksum. The download page lists a SHA256 checksum for every zip. Compare it before you install, for example with certutil -hashfile php-8.5.12-nts-Win32-vs17-x64.zip SHA256 (use your file name).

Treat any "patched PHP" zip from anywhere but windows.php.net or your platform vendor as untrusted.

How to Patch PHP for IIS

The full step-by-step for IIS, including why php-cgi.exe processes need a restart, is in our php-cgi and PHP2Shell guide. In short:

1. Note the PHP folder IIS uses (the FastCGI fullPath).
2. Back up that folder, including php.ini and any extra extension files.
3. Download and verify the fixed NTS build for the same branch.
4. Replace the PHP files, keeping your php.ini. AWS's Windows instructions say the same: "replace your existing installation. Keep your existing php.ini file."
5. Restart IIS: iisreset /restart, which Microsoft documents as stopping IIS "and then start it again."
6. Confirm the version from a page the site serves (see below).

IIS keeps php-cgi.exe processes running between requests, recycling each only after 200 requests by default, so restart rather than wait.

If you load extra PHP extensions that don't come in the PHP zip, check that they still load after the swap. Run php -m from the PHP folder and compare the list with what you had before.

How to Patch PHP for Apache on Windows

Apache on Windows usually loads PHP as a module (a DLL inside the PHP folder), so Apache is what you restart. Use the TS build for the same branch, replace the PHP files the same way, and keep php.ini.

Then stop and start Apache. The Apache documentation for Windows describes httpd.exe -k restart as the Windows equivalent of a graceful restart: "Any operations in progress are allowed to complete." Apache's documentation never says whether a graceful restart loads an updated PHP module, so use a full stop and start instead. For a service, Apache documents these forms (replace the service name with yours):

httpd.exe -k stop -n "MyServiceName"
httpd.exe -k start -n "MyServiceName"

The Apache project itself publishes no Windows binaries, only source code, so if your Apache came from a third-party build or a bundle, check that vendor's site for its own update too.

Restart commands for every other setup are in our guide to restarting PHP workers.

How to Verify the Fix on Windows

Windows makes it easy to check the wrong PHP. Typing php -v in a command prompt runs whichever php.exe is first on the PATH, which may not be the one IIS or Apache uses. Instead:

1. Run the right php.exe. Change to the folder your web server uses and run .\php.exe -v. For a fixed upstream build, it shows 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later.
2. Check for the new setting. PHP's manual says memory_hard_limit_percent is "Available as of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35," and that if it "is not recognized, the PHP version in use is affected." For example: .\php.exe -i | findstr memory_hard_limit_percent should print a line. This test is reliable for windows.php.net builds of those releases.
3. Check what the site serves. Put a temporary phpinfo page on the site, load it, read the PHP version and the "Loaded Configuration File" line, then delete the page. Our guide on how to check your PHP version covers this and the safer alternatives.

The PHP2Shell version lookup tells you whether a version is fixed. On Windows builds from windows.php.net, the version number is the whole story; there are no hidden backports to account for.

PHP 8.1 and Older on Windows

PHP 8.1 and older get no new release from the PHP project. PHP published minimal source-code backports for 7.4, 8.0 and 8.1, but no Windows binaries; the newest 8.1 build in windows.php.net's archive is still 8.1.34. In practice, a Windows server on 8.1 or older has three options:

• Upgrade to 8.2 or newer. This is the real fix. Test the application first, ideally on a copy of the site. Remember that 8.2 itself reaches end of life on 31 December 2026.
• Use a commercial extended-support build. CloudLinux says TuxCare ELS has released fixed PHP for Windows. We could not read TuxCare's own pages to confirm versions, so get them from TuxCare in writing.
• Take it offline or isolate it. CISA, the UK NCSC and the EU's ENISA all advise taking unpatchable PHP systems offline or isolating them from the public internet until they can be fixed.

Azure App Service for Windows is a special case. Microsoft says its built-in Windows PHP runtimes are end-of-life and "No security patch for these runtimes is currently planned," and the same applies on Azure Stack Hub. Plan to move those apps to a supported runtime, such as App Service on Linux, where Microsoft has rolled out fixed PHP 8.2.35 to 8.5.12, or a container you rebuild yourself.

Interim Settings on Windows

PHP's interim settings work on Windows too, as long as they are set in php.ini, which PHP reads at startup. PHP says not to rely on ini_set() or .user.ini for the session setting. After editing php.ini, restart IIS or Apache so the change takes effect.

One setting is worth keeping even after you patch: session.upload_progress.enabled=0. PHP suggests it until its next regular release because of a separate, lower-risk issue (CVE-2026-115560) that affects fixed releases too, unless you use PHP's built-in upload progress feature. The rest of the list, and what each setting can break, is in our PHP2Shell interim mitigations guide. None of them replaces the update.

Before and After: Backups and Ownership

Back up the PHP folder and the site before you swap anything. If an extension fails to load or the site breaks, you can put the old folder back in minutes while you fix the problem, then patch again. Our backup and recovery guide explains what to keep.

If your site is on Windows hosting you don't control, the host owns PHP. Ask them which PHP build serves your site and when it was restarted. Our shared responsibility model guide explains which part is yours.

Conclusion

As of 23 October 2026, fixed PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 builds for Windows are on windows.php.net. Find every copy of PHP your web servers use, install the NTS build for IIS or the TS build for Apache on the same branch, keep php.ini, restart IIS or stop and start Apache, and check the version from a page the site serves. For PHP 8.1 and older, upgrade, use a vendor build you can verify, or isolate the server. If you run Windows servers and want help patching and verifying them, our emergency PHP patching team can step in. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions