This article is created temporarily in a response to the PHP2Shell Vulnerability so that server administrators can patch their systems immediately after release.
This article is designed for MediaCP Stable & Latest branches only where MediaCP 2.15 or 2.16 are installed and running on PHP 8.3.
For earlier MediaCP versions running on PHP 7.4 you will need to either upgrade to MediaCP Stable or wait for MediaCP to release an update for the LTS branch.
Requirements
- MediaCP 2.15.x, 2.16.x, or newer only. Do not use this guide on 2.14.x or older, which use PHP 7.4.
- The PHP security advisory must confirm PHP 8.3.36 or newer as patched/fixed.
- Root SSH access, console access, a maintenance window, and a tested full server backup/snapshot.
1. Prepare and back up PHP
We recommend restricting MediaCP panel access to trusted VPN/static IP addresses during this process.
Confirm the installed versions, then set the anticipated fixed PHP release:
/usr/local/mediacp/php/bin/php -v
cat /usr/local/mediacp/versions/mediacp
export PHP_VERSION='8.3.36'
Copy the entire existing MediaCP PHP installation to a rollback location. This preserves the PHP binary, PHP-FPM configuration, php.ini, extensions, ionCube loader, and custom configuration.
export BACKUP_ROOT="/usr/local/mediacp/php.pre-${PHP_VERSION}-$(date -u +%Y%m%dT%H%M%SZ)"
cp -a /usr/local/mediacp/php "${BACKUP_ROOT}"
test -x "${BACKUP_ROOT}/bin/php"
test -f "${BACKUP_ROOT}/etc/php-fpm.conf"
MediaCP uses /usr/local/mediacp/php; updating the operating system's php or php-fpm package does not update MediaCP.
2. Build the fixed PHP release
Download the official PHP source. Build it for the existing MediaCP PHP directory, but do not run make install yet.
mkdir -p /root/mediacp-php-build && cd /root/mediacp-php-build
curl --fail --location --remote-name "https://www.php.net/distributions/php-${PHP_VERSION}.tar.xz"
tar -xJf "php-${PHP_VERSION}.tar.xz"
cd "php-${PHP_VERSION}"
./buildconf --force
./configure \
--prefix=/usr/local/mediacp/php \
--with-mysql-sock=/usr/local/mediacp/mysql/data/mysql.sock \
--with-mysqli --enable-bcmath --enable-ftp --with-pear --with-zlib \
--enable-gd --with-jpeg --with-webp --with-freetype --enable-pcntl \
--with-curl --with-pdo-mysql --enable-pdo --enable-mbstring --with-zip \
--with-openssl --enable-simplexml --enable-opcache --disable-phpdbg \
--with-fpm-user=mediacp --with-fpm-group=mediacp --enable-fpm \
--enable-sockets --enable-intl --with-ffi=shared \
--with-config-file-path=/usr/local/mediacp/php \
--with-config-file-scan-dir=/usr/local/mediacp/php:/usr/local/mediacp/php/php.d
make -j"$(nproc)"
make installIf the MediaCP installer for the host uses a distribution-specific OpenSSL option, use the same option here. Do not substitute an arbitrary OpenSSL directory.
If the curl fails from php.net website, then you can also try direct from github:
wget https://github.com/php/php-src/archive/refs/tags/php-${PHP_VERSION}.tar.gz
3. Check version and restart mediacp
/usr/local/mediacp/php/bin/php -v
/usr/local/mediacp/service restart php
4. Roll back
If PHP-FPM does not start or any MediaCP function fails, restore the copied PHP installation:
/usr/local/mediacp/service stop php
cp -a "${BACKUP_ROOT}/." /usr/local/mediacp/php/
/usr/local/mediacp/service start php
/usr/local/mediacp/php/bin/php -v
Rollback restores the vulnerable runtime, so keep panel access restricted until a supported patched runtime is installed.
