BaoTa & 1Panel
Panel PHP installations can be independent of system PHP. List every installed version and map each site to its assigned runtime. Use the panel’s trusted update channel and verify its package or image contains both CVE fixes; do not assume updating the panel updates PHP. Restart each affected PHP service or recreate the managed container. Check each site again after switching handlers. Panel menu names vary by release.
1. Identify the actual Web runtime
Record the PHP branch, complete package revision, installation source, loaded extensions, service name and site handler. The CLI and Web server may run different binaries. In multi-PHP panels, inspect each site’s assigned handler. Inventory every FPM pool, Apache instance, image, queue worker and deployment replica. Keep a backup and a tested rollback plan before changing production.
3. Restart and verify every instance
Installing a new binary leaves old worker processes in memory until they exit. Restart Apache for mod_php or the corresponding PHP-FPM services and pools. Restart queue workers and scheduled long-running processes too. Verify service start times, Web runtime version, package revision, health checks and every load-balanced replica. Delete any temporary diagnostic page immediately; do not leave phpinfo() publicly accessible.