Fix guides / aaPanel / BT Panel
Fix php2shell on aaPanel / BT Panel (宝塔)
aaPanel compiles PHP from source into /www/server/php, one directory per version, so it uses upstream numbering: each version must reach 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. System package updates (apt or yum) do not touch these builds.
These steps fix CVE-2026-109618 and CVE-2026-109619. Upstream releases and distribution package numbers are in the fixed versions table.
Can’t update right now? Apply the temporary mitigations.
Not sure which PHP your site uses? Start with the self-check.
1. Find every installed version
Installed versions:
for p in /www/server/php/*/bin/php; do echo "$p: $($p -r "echo PHP_VERSION;")"; done2. Install the update
In the panel: App Store → PHP-x.y → Settings → Update, or reinstall the latest minor version.
If the panel doesn’t offer a fixed version yet, apply the temporary mitigations and check again later. Don’t replace the panel’s PHP with an unofficial build.
Sites on PHP 8.1 or older get no upstream fix: install 8.2 or later and switch the site in Website → PHP version.
3. Restart PHP
Restart the FPM service of each updated version (replace 83):
/etc/init.d/php-fpm-83 restart4. Verify
Run the version loop from step 1 again, then confirm the version your website really uses with the temporary file from the self-check page.
Other environments
FAQ
I ran apt upgrade / yum update. Is aaPanel’s PHP fixed?
No. aaPanel’s PHP is compiled separately under /www/server/php and is only updated from the panel.