mod_php or PHP-FPM? Why it matters for PHP2Shell, and how to tell which your site uses
Short answer
The way a server connects PHP to the web server is called the SAPI. WordPress shows it in Tools → Site Health → Info → Server, on the line PHP SAPI: apache2handler means Apache with mod_php, fpm-fcgi means PHP-FPM, litespeed means LiteSpeed. For the October 2026 PHP flaws, php.net considers the risk highest for mod_php, where a demonstrated exploit works “before any application code runs”. But every SAPI is concerned: the answer is the same everywhere, update PHP. The SAPI tells you how urgent “today” is.
Where to see it
In your WordPress admin: Tools → Site Health → Info → Server. Just below PHP version is PHP SAPI. WordPress fills it from PHP’s own PHP_SAPI value (WordPress 7.1.2 source).
php.net lists the values you may see, among them apache2handler, cgi-fcgi, fpm-fcgi and litespeed (php.net):
| PHP SAPI | Means |
|---|---|
apache2handler | PHP runs inside Apache (mod_php) |
fpm-fcgi | PHP-FPM, a separate pool of PHP workers |
cgi-fcgi | PHP started through CGI or FastCGI |
litespeed | LiteSpeed’s PHP handler |
Why it matters this time
php.net’s advisory of 21 October 2026: “Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” (php.net)
Before any application code runs means before WordPress, its plugins or a security plugin even start. Nothing at the WordPress level can stand in the way; only the PHP update can.
PHP-FPM is no safe harbour: the advisory for CVE-2026-109619 reports a validated attack on PHP-FPM through PHP’s session handling (GHSA-6wmf-4rv5-p3rp).
What to do with this
- Read both lines in Site Health: PHP version and PHP SAPI (how).
- Not patched and
apache2handler? Treat it as the most urgent case: contact your host today (what to ask). - Not patched, any other SAPI? Same request, same day.
- Patched? Nothing more to do for these two flaws.
The flaws themselves, in plain words: CVE-2026-109618 and CVE-2026-109619 explained. What to do overall: PHP2Shell.
Key takeaways
- Site Health → Info → Server → PHP SAPI shows how your host runs PHP.
apache2handler: Apache with mod_php.fpm-fcgi: PHP-FPM.cgi-fcgi: CGI.litespeed: LiteSpeed.- php.net: risk highest for mod_php, with a demonstrated unauthenticated exploit.
- PHP-FPM, CGI, LiteSpeed and FrankenPHP are concerned too; update regardless.
- You rarely choose the SAPI on shared hosting; you do choose to ask for the update.
Frequently asked questions
Should I switch from mod_php to PHP-FPM because of this?
Updating PHP is what fixes the flaws, on any SAPI. Whether to change SAPI is a separate decision for whoever manages the server; on shared hosting, it’s usually not yours to make.
My site uses PHP-FPM. Can I wait?
No: php.net lists PHP-FPM among the setups at risk, and the second flaw’s advisory reports a validated attack on PHP-FPM through the session path. Ask for the update now.
Can I change the SAPI in WordPress?
No. It’s a server setting. Some hosting panels offer a choice of handler per site, such as Plesk’s handler type menu.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
- php.net: Security advisory, 21 October 2026
- php.net: php_sapi_name()
- WordPress 7.1.2 source: Site Health Info (class-wp-debug-data.php)
- GitHub: GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.