PHP2Shell is fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If your server runs PHP 5.6 to 8.1 that you or your host compiled from source, there is no release to install. Your 7.4.33 is the last 7.4 release ever, and it is vulnerable. This guide shows how to patch that PHP in place with three scripts. The first reads how your PHP was built. The second rebuilds it with the fix on another machine. The third swaps the new binaries in, with checks and a rollback.

No control panel is needed, no Docker, and nothing is compiled on the server itself.

Earlier this week I wrote about patching PHP 5.6 to 8.1 on our RunCloud servers . Several readers asked the same question: what if I'm not on RunCloud? This article is the answer.…