php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available

Key points

Ubuntu has published fixed PHP packages for all supported releases to address php2shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that let an unauthenticated attacker run arbitrary code through any PHP application. Public disclosure was brought forward one day after a leak.

The vulnerabilities

• Tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 4.0 score 9.2 (CRITICAL).
• Any PHP application is affected. An attacker without credentials who can reach the web application over the network can easily execute arbitrary code on the host, with the privileges of the PHP application.
• The PHP Foundation coordinated disclosure with distributors for 22 October 2026 at 14:00 UTC. After a public leak, disclosure moved to 21 October 2026 at 14:00 UTC.

Fixed versions

• Trusty (14.04), php5: 5.5.9+dfsg-1ubuntu4.29+esm18
• Xenial (16.04), php7.0: 7.0.33-0ubuntu0.16.04.16+esm22
• Bionic (18.04), php7.2: 7.2.24-0ubuntu0.18.04.17+esm14
• Focal (20.04), php7.4: 7.4.3-4ubuntu2.29+esm5
• Jammy (22.04), php8.1: 8.1.2-1ubuntu2.28
• Noble (24.04), php8.3: 8.3.6-0ubuntu0.24.04.13
• Resolute (26.04), php8.5: 8.5.4-0ubuntu1.5
• Stonking (26.10), php8.5: 8.5.9-0ubuntu2.1
• Related notices are USN-8948-1 and USN-8948-2; PHP's own advisory is on php.net.

How to check

• List the installed PHP interpreter packages and their versions, then compare them with the table above:

apt list '?installed ?name(^php[0-9.]+$)'

How to fix

• Ubuntu recommends upgrading all packages:

sudo apt update && sudo apt upgrade

• If a full upgrade is not possible, upgrade only the PHP interpreter packages:

sudo apt update && sudo apt install --only-upgrade '?name(^php[0-9.]+$)'

• Applications using PHP probably need a restart afterwards. For example, a setup with apache2 and mod_php requires restarting Apache:

sudo systemctl restart apache2

• Rebooting also makes sure every application picks up the updated packages:

sudo reboot

• unattended-upgrades is on by default from Ubuntu 16.04 LTS onwards and installs security updates every 24 hours. It will bring in these fixes within a day of release, but affected applications still have to be restarted or the system rebooted.

Support coverage

• Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS receive the fixes through standard support.
• For Ubuntu 20.04 LTS and older, the fixes come through an Ubuntu Pro subscription, which offers coverage for up to 15 years. Ubuntu 20.04 LTS and 18.04 LTS are covered by Expanded Security Maintenance (ESM); Ubuntu 16.04 LTS and 14.04 LTS need ESM with the Legacy add-on.
• Ubuntu Pro is free for up to 5 machines, or up to 50 for community members, and includes Landscape for managing how fixes roll out across many machines.

Summary by DistroNews, based on the original post.