Changing the PHP Version at o2switch After the October 21, 2026 Vulnerability: A Step-by-Step Guide for cPanel

Since October 21, 2026, two critical vulnerabilities in PHP allow taking control of a server without a password. At o2switch, as with any shared hosting provider, it is the hosting company that installs corrected versions of PHP on its servers, but only for maintained branches, from 8.2 to 8.5. However, the default 'native' version offered in cPanel at o2switch is PHP 8.1, and PHP 8.1 no longer has an officially corrected version. If you have never adjusted the settings, there’s a good chance your site is running on it. Here’s where to click and what to choose.

Before you begin: the verification tool recognizes sites hosted by o2switch thanks to the 'Server' header of their servers and tells you what the host has announced. The full context of the vulnerability is in the main article.

What o2switch did on October 21

According to Clubic’s report published at 6:25 PM, o2switch acted quickly: as early as 8:07 AM, the functionality involved in one of the two vulnerabilities, session.upload_progress, was disabled in the PHP configuration of its servers, followed by a process restart. This is a temporary fix that only covers one of the two vulnerabilities, according to CERT-FR. At 4:40 PM, the installed PHP binaries still dated back to October 6, in versions 8.3.35 and 8.4.26, while the patched versions 8.3.36 and 8.4.27 had just been released. At 5:30 PM, support explained they were waiting for CloudLinux packages, the editor of their server system, announced for the evening, and promised deployment 'as soon as possible' once these packages were validated. In the details I could read myself by the end of the day, o2switch servers hide the PHP version, which is a good practice but requires checking cPanel.

The trap of the 'native' version

In the cPanel tool 'Select PHP Version,' the default checked version is the so-called native version, and o2switch’s FAQ states it is PHP 8.1. Many sites created over the past two years have never changed this setting. The issue: PHP 8.1 has been end-of-life since December 31, 2025, and the PHP project has not released a corrected version for this branch, only a source patch to compile.

There is a nuance: CloudLinux, whose system o2switch uses, sometimes backports security fixes to older PHP branches. o2switch will confirm if this applies to 8.1 and when. Until a written response, switching to 8.3 or 8.4 is the only certainty, and it takes two minutes.

Where to click in cPanel

Log in to cPanel, under the section Software, then open the tool Select PHP Version. The dropdown menu displays the current version. Choose 8.3 or 8.4, then click on Apply: the button disappears once the setting is saved, which is normal. A list of extensions then appears, with the basic extensions already checked: leave them as they are. The Extension tab is used to activate others if your site needs them, the Options tab allows you to adjust the php.ini, and Reset to default resets everything if you're unsure. o2switch offers all PHP versions from 4.4 to 8.5 in this menu, which clearly shows that the choice is yours.

Which version to choose

PHP 8.3 or 8.4: the safe choice for WordPress, WooCommerce, or a recent tool. The patched versions are 8.3.36 and 8.4.27, with security fixes until 2027 and 2028.

PHP 8.2: patched up to 8.2.35, but the branch ends on December 31, 2026: you’ll need to perform the update again before the end of the year.

PHP 8.5: patched up to 8.5.12 and available at o2switch, but it’s the newest branch, and some WordPress or PrestaShop extensions haven’t been updated yet. For a production site, 8.3 or 8.4 is the best balance.

Before upgrading from 7.4 or 8.0, check that your theme and extensions support the target version: WordPress itself works from 7.4 to 8.5, but older extensions may break.

Verify that the patch is properly installed

The cPanel menu displays the branch, not the exact patch number. To see that number, check the phpinfo page or in WordPress Tools, then Site Health, tab Info, section Server. The numbers to appear are 8.2.35, 8.3.36, 8.4.27, or 8.5.12. As long as you see 8.3.35 or 8.4.26, the CloudLinux packages haven’t been applied to your server yet: o2switch communicates through its usual channels, and the verification tool updates the hosting provider’s status as this page is refreshed.

If the site breaks after the change

the reflex is the same as everywhere: revert to the previous version in the same menu, long enough to update the faulty extension or theme, then roll back. A blank page or a 500 error right after the change almost always comes from a missing PHP extension in the list or a removed function between branches. Backing up outside the server before any action is not optional, and cPanel offers a backup tool for this purpose.

And if you don’t want to handle it yourself

I perform this intervention remotely: backup, testing on a copy, version change, patch verification, testing of the homepage, administration, and a payment, followed by a written report. One hour for a simple site, half a day for a busy store. Write to me with your site’s link, I’ll respond within 24 hours. The same guides exist for OVHcloud and IONOS.

Sources: FAQ o2switch « Select a PHP version », ranking of hosting providers by Clubic on October 21 at 6:25 PM, alert CERTFR-2026-ALE-014, fixed versions on php.net.