OFFICIAL REMEDIATION GUIDE

How to Patch PHP2Shell on Ubuntu Linux using apt

Step-by-step patch guide for Ubuntu 24.04, 22.04 and 20.04 LTS against CVE-2026-109618 and CVE-2026-109619. Verify package changelog backports and restart PHP-FPM.

Ubuntu distributions backport security fixes without changing the upstream minor release number. For instance, Ubuntu 22.04 LTS stays on PHP 8.1, but receives package security updates (e.g. 8.1.2-1ubuntu2.28).

Step 1: Check Installed PHP Packages

Inspect all active PHP runtime packages installed on your Ubuntu server:

dpkg -l 'php*' 'libapache2-mod-php*' | grep ^ii

Step 2: Verify If Your Package Contains the Backported Fix

Search your local package changelog for the CVE identifiers:

zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php*-common/changelog.Debian.gz

If the changelog mentions CVE-2026-109618 or CVE-2026-109619, your package is patched.

Step 3: Update PHP Packages via apt

Update your repositories and upgrade PHP packages:

sudo apt-get update && sudo apt-get --only-upgrade install "php8.*"

Step 4: Restart PHP-FPM and Web Server Daemons

Workers must be restarted so the new binary loads into active memory:

sudo systemctl restart php*-fpm apache2 nginx

← All Platform Guides Launch Diagnostic Checker → CVE-2026-109618 Advisory → CVE-2026-109619 Advisory →