Knowledgebase

This article is created temporarily in a response to the PHP2Shell Vulnerability so that server administrators can patch their systems immediately after release.

This article is designed for MediaCP LTS only where MediaCP 2.11, 2.12, 2.13, or 2.14 is installed and running on PHP 7.4.
MediaCP 2.15 and newer use PHP 8.3 and should follow the PHP 8.3 update procedure instead.

MediaCP support can complete this for you on compatible operating systems apart of a Professional Service Request.

Requirements

• MediaCP 2.11, 2.12, 2.13, or 2.14 only
• An existing MediaCP OpenSSL 1.1.1 compatibility installation in /usr/local/mediacp/openssl-*.
• Root SSH access, console access, a maintenance window, and a tested full server backup/snapshot.
• An operating system with access to active APT and YUM repositories
• CentOS 7 may require a compatible libzip and libzip-devel package which might be unavailable.

1. Install build dependencies

Debian or Ubuntu:

apt-get update
apt-get install -y build-essential autoconf automake libtool bison re2c pkg-config \
  libcurl4-openssl-dev libssl-dev libzip-dev libjpeg62-turbo-dev \
  libfreetype6-dev libsqlite3-dev libonig-dev libpng-dev libwebp-dev \
  libffi-dev libxml2-dev libicu-dev

CentOS, AlmaLinux, or Rocky Linux:

yum groupinstall -y "Development Tools"
yum install -y autoconf automake libtool bison re2c pkgconfig \
  libcurl-devel openssl-devel libzip-devel libjpeg-turbo-devel \
  freetype-devel libpng-devel libwebp-devel libxml2-devel libicu-devel \
  oniguruma-devel sqlite-devel libffi-devel

2. Back up the existing MediaCP PHP installation

BACKUP_DIR="/usr/local/mediacp/php-backup-$(date +%Y%m%d-%H%M%S)"
cp -a /usr/local/mediacp/php "$BACKUP_DIR"

3. Download the patched PHP source

PHP_VERSION="7.4.34-dev"
BUILD_DIR="/usr/local/src/mediacp-php-build"

mkdir -p "$BUILD_DIR"
cd "$BUILD_DIR"

curl --fail --location \
  "https://mirror.mediacp.net/download/common/php-${PHP_VERSION}.tar.gz" \
  -o "php-${PHP_VERSION}.tar.gz"

tar -xzf "php-${PHP_VERSION}.tar.gz"
cd "php-${PHP_VERSION}"

4. Build and install PHP

export OPENSSL_PREFIX="$(find /usr/local/mediacp -maxdepth 1 -type d -name 'openssl-*' -print -quit)"
export PKG_CONFIG_PATH="${OPENSSL_PREFIX}/lib/pkgconfig${PKG_CONFIG_PATH:+:${PKG_CONFIG_PATH}}"
export OPENSSL_CONF="${OPENSSL_PREFIX}/openssl.cnf"
export LD_LIBRARY_PATH="${OPENSSL_PREFIX}/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
export BUILD_OPENSSL="--with-openssl=${OPENSSL_PREFIX}"

Build and install PHP:

./buildconf --force

./configure \
  --prefix=/usr/local/mediacp/php \
  --with-mysql-sock=/var/lib/mysql/mysql.sock \
  --with-mysqli \
  --enable-bcmath \
  --enable-ftp \
  --with-pear \
  --with-zlib \
  --enable-gd \
  --with-jpeg \
  --with-webp \
  --with-freetype \
  --enable-pcntl \
  --with-curl \
  --with-pdo-mysql \
  --enable-pdo \
  --enable-mbstring \
  --with-zip \
  ${BUILD_OPENSSL} \
  --enable-simplexml \
  --enable-opcache \
  --disable-phpdbg \
  --with-fpm-user=mediacp \
  --with-fpm-group=mediacp \
  --enable-fpm \
  --enable-sockets \
  --enable-intl \
  --with-ffi=shared \
  --with-config-file-path=/usr/local/mediacp/php \
  --with-config-file-scan-dir=/usr/local/mediacp/php:/usr/local/mediacp/php/php.d

make -j"$(nproc)"
make install

This installs PHP over /usr/local/mediacp/php while preserving the existing MediaCP PHP configuration.

5. Restart and verify

/usr/local/mediacp/service restart php

/usr/local/mediacp/php/bin/php -v

The version output must include:

PHP 7.4.34-dev

Confirm that the MediaCP panel and a representative stream or website operate normally.

Rollback

If the build or verification fails, restore the backup and restart PHP:

mv /usr/local/mediacp/php /usr/local/mediacp/php-failed
mv "$BACKUP_DIR" /usr/local/mediacp/php
/usr/local/mediacp/service restart php

Restoring the previous PHP installation reintroduces the security vulnerability. Contact MediaCP support if the patched build cannot be completed.