php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available

Introduction

Two critical security vulnerabilities affecting PHP have been identified that result in unauthenticated remote code execution (RCE) for any PHP application. The vulnerabilities have been assigned the CVE-2026-109618 and CVE-2026-109619 identifiers, but are also referred to using the php2shell nickname. Ubuntu has released fixes for the affected packages for all supported releases.

The two vulnerabilities both have a CVSS 4.0 score of 9.2, corresponding to a severity of CRITICAL.

The vulnerabilities have been responsibly disclosed and the PHP Foundation has engaged in coordinated vulnerability disclosure (CVD) with distributors, establishing a public disclosure date of 22 October 2026 at 14:00 UTC. However, due to a public leak, the disclosure date has been moved forward to 21 October 2026 14:00 UTC.

Which Ubuntu releases are affected by php2shell?

How to check if you are impacted by php2shell

You can verify the versions of any packages installed matching the PHP interpreter package name with the following command:

apt list '?installed ?name(^php[0-9.]+$)'

Impact of php2shell

The two vulnerabilities affect any PHP application. An unauthenticated attacker with network access to the web application can trivially achieve arbitrary remote code execution with the PHP application’s credentials on the target system.

How to apply fixes for php2shell

We recommend you upgrade all packages:

sudo apt update && sudo apt upgrade

If this is not possible, the affected component can be targeted:

sudo apt update && sudo apt install --only-upgrade '?name(^php[0-9.]+$)'

The application that uses the PHP interpreter would likely need to be restarted. For example, for an application using apache2 with mod_php, restarting the apache daemon is required:

sudo systemctl restart apache2

Alternatively, the system can be rebooted to ensure that all applications use the updated components:

sudo reboot

The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This feature:  

• Applies new security updates every 24 hours automatically.
• If you have this enabled, the patches above will be automatically applied within 24 hours of being available, but the affected applications would still need to be restarted or the system rebooted.

Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support. If you are using Ubuntu 20.04 LTS or older, you can apply this fix with an Ubuntu Pro subscription via the Expanded Security Maintenance (ESM) service. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members. Ubuntu Pro also provides access to Landscape which enables you to control the roll-out of security fixes across your estate. Learn more.

References

• https://ubuntu.com/security/notices/USN-8948-1
• https://ubuntu.com/security/notices/USN-8948-2
• https://www.php.net/archive/2026.php#2026-10-21-5