PHP2Shell: patch PHP on your server today
Two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, were fixed on 21 October. What's affected, what we changed, and where the step-by-step guide is.
On 21 October the PHP project fixed two bugs, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated web request run code through PHP. They're being called PHP2Shell. PHP rates both 9.2 out of 10, and Cloudflare and watchTowr saw exploitation attempts on release day. Public exploit code is circulating, though PHP's security team hadn't found a working one when it published the fix.
If your server runs PHP for a website, WordPress included, update it today. PHP2Shell: check and patch PHP on your VPS has the commands for Ubuntu, Debian, AlmaLinux, Rocky Linux, Fedora and Arch, the fixed package versions where distributions have published them, and what to do about third-party repositories and PHP 7.4 to 8.1.
Two things to know
php -v can mislead you. Distributions patch the PHP version they shipped instead of moving to PHP's new release, so a fixed Ubuntu 24.04 server still says 8.3.6. Check the package version instead; the guide lists them.
Updating isn't enough until PHP-FPM restarts. The old code keeps running in memory until the process restarts. The guide shows how to check that the running PHP is the new one.
What we changed
Our own site and panel are written in Node.js and don't run PHP, so there's nothing to patch on our side.
Customers get PHP from two one-click apps, LEMP and WordPress. Both install your distribution's own PHP, and new installs of either now also:
- turn on automatic security updates: unattended-upgrades on Ubuntu and Debian, dnf-automatic on AlmaLinux, Rocky Linux and Fedora, security fixes only, once a day;
- restart PHP-FPM whenever an update replaces code it is running;
- never reboot the server on their own, so a kernel update waits for you.
Automatic updates can only install a fix your distribution has published. At the time of writing, Ubuntu and Debian have; Red Hat had fixed RHEL 8 but not yet 9 or 10, which AlmaLinux and Rocky Linux rebuild, so servers on those may need the stopgaps in the guide for a few days.
Servers set up before this change keep whatever their distribution does by default. Ubuntu installs security updates automatically, though a service can keep running old code until it restarts; the others may not install them at all. Either way, turning on automatic security updates takes two minutes.