Every PHP handler on your panel needs checking.
cPanel and Plesk servers usually run several PHP versions for hundreds of accounts. The new PHP flaws affect all versions before the fixed releases, and end-of-life versions left for old sites will stay exposed.
Is the PHP cPanel & Plesk servers runs on affected?
Run php -v on the server. A patched version on disk only protects you after every PHP worker restarts. Distro packages can carry backported fixes under older version numbers, so we confirm against your vendor's changelog.
What makes these sites a target.
Many versions per server
EA-PHP, alt-php and Plesk-supplied PHP builds sit side by side. Each one needs its own update.
Customers choose old versions
MultiPHP and Plesk let account owners pick end-of-life PHP versions for compatibility.
Per-account overrides
Settings in .htaccess or .user.ini can quietly undo hardening. The advisory recommends putting protective settings in the main php.ini.
Shared risk
One exploited account can expose neighbors on the same server, along with your hosting reputation.
How we fix it on cPanel & Plesk servers.
The first commands we run, read-only:
whmapi1 php_get_installed_versions # cPanel plesk bin php_handler --list # Plesk systemctl list-units --type=service | grep -Ei 'php|lsws|httpd'
Inventory
We list installed PHP versions and handlers, and count accounts on each version.
Update packages
We update every supported PHP build to the patched release and check vendor backports for end-of-life builds.
Restart services
We restart PHP-FPM, Apache or LiteSpeed and confirm the running workers are new.
Harden and communicate
We set server-wide php.ini defaults and draft the notice for customers still on end-of-life PHP.
Any cloud, any VPS, any server.
The fix is the same everywhere: a patched PHP build, restarted workers and hardened settings. We work on VMs, containers, Kubernetes, serverless runtimes and control-panel hosting.
Pick how much you want us to do.
Exposure check
- Every PHP version and server you run, listed
- Clear verdict: exposed or not, and how urgent
- Written report with next steps
Fixed fee, credited toward remediation
Guided remediation
- Upgrade plan for your platform and hosting
- Temporary hardening while you wait
- Edge and WAF rules written for your routes
- We review your team's work and verify it
Hourly or fixed package
Full repair and upgrade
- Staging test, upgrade and rollback plan
- Patched PHP on every server and container
- All workers restarted and verified
- Hardening, monitoring and a closing report
Fixed quote per environment
Patch watch
- We track PHP and platform advisories
- Quarterly version and config checks
- Priority response for the next critical CVE
Monthly retainer
From first call to verified fix.
Authorize
You sign a short scope and authorization. We don't scan or touch any system without it.
Inventory
We record every PHP version, server, container and worker process in scope.
Plan
You get a fixed quote, a schedule and a rollback plan before any change.
Patch and restart
We upgrade PHP and restart every worker so no vulnerable code stays in memory.
Verify
We confirm the fix on every host and hand over a written report.
Don't restart the server yet.
If you see shells or tools like curl launched by PHP processes, PHPSESSID cookies longer than 256 bytes, or a spike in PHP worker crashes, contact us before you patch. Restarting wipes the memory evidence that shows what an attacker did. We preserve that evidence first, then work with an incident response firm if the investigation needs one.
cPanel & Plesk servers questions.
Does CloudLinux alt-php cover old versions?
Some vendors backport security fixes to older builds. We check whether a fix for these CVEs has shipped for each build you run.
We're a reseller without root access.
We'll prepare the request for your upstream host and verify the result from your accounts.
Can you help us tell customers?
Yes. We draft a plain-language notice explaining the risk and the upgrade deadline.
Find out where you stand this week.
Tell us what you run on cPanel & Plesk servers and where it's hosted. We'll reply within one business day with a time for the exposure check.
Include your platform, approximate number of sites or servers, and your hosting provider.