Fixed PHP packages on Linux

Linux distributions fix PHP2Shell in their own packages. Some, such as Ubuntu and the RHEL 9 default PHP, keep the old PHP number. After the update, php -v can still say 8.3.6. Compare your package version with the fixed package below.

Last reviewed 22 October 2026. Rules of 22 October 2026.

One guide per distribution: Ubuntu, Debian, RHEL, AlmaLinux and Rocky Linux, Alpine. Each has the commands to see the installed build and to restart PHP. On PHP 7.4, 8.0 or 8.1, see no fixed release.

How to update

1. Find your release and the PHP package you use.
2. Install the update with your package manager.
3. Restart PHP-FPM and the web server. The old processes keep the old code until they stop.

The tables cover PHP from each distribution’s own repositories. If your PHP comes from a hosting panel, a hosting provider or a third-party repository, ask that vendor for its fix.

Ubuntu

Check and update:

# show installed PHP packages and versions
dpkg -l | grep -E '^ii +(php[0-9.]*-(fpm|cgi|common)|libapache2-mod-php)'
# install the update
sudo apt update && sudo apt upgrade
# restart (use your branch, for example php8.3-fpm)
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2

On 20.04 and 18.04 the fix comes through Ubuntu Pro (ESM). On 16.04 and 14.04 it needs Ubuntu Pro with the Legacy Support add-on. Without them, apt upgrade does not install the fix.

Debian

The tracker has no row for Debian 11 bullseye. If you still run it, ask your support vendor or upgrade the release.

The Ubuntu commands above work here too. Put your branch in the service name, for example php8.2-fpm.

Red Hat Enterprise Linux

RHEL 7 and earlier: Red Hat's sources disagree. The bulletin RHSB-2026-013, updated on 2026-10-22, lists RHEL 7 as affected by CVE-2026-109619 only. Red Hat's machine-readable data (VEX for CVE-2026-109619) marks RHEL 6 and 7 as not affected by CVE-2026-109619. For CVE-2026-109618 (VEX) they are still under investigation. Neither lists a fix. Our advice: treat RHEL 7 as affected and watch the bulletin. See RHEL 7 and 6.

Red Hat's data lists fixes only for the streams above. Red Hat also says to rebuild your own containers when the base images are updated.

AlmaLinux

AlmaLinux moved fixed packages for every PHP stream on AlmaLinux 8, 9 and 10 to the production repositories on 2026-10-21. Most are AlmaLinux's own backports. They keep older upstream numbers and end in .alma.1. On 2026-10-22, errata.almalinux.org had no advisory IDs for them yet. The versions below come from AlmaLinux's announcement of 2026-10-21.

AlmaLinux says php:7.2, php:7.3 and php:8.0 on AlmaLinux 8, and php:8.1 on AlmaLinux 9, are past their life cycle. They got this fix, but future fixes are not guaranteed. Plan a move to a supported stream. AlmaLinux Kitten 10 gets the fix with its next regular PHP update.

Rocky Linux

Rocky module builds have the same upstream version and release as Red Hat, but a different build suffix. Compare against the Rocky string, not the Red Hat one.

Commands for RHEL, AlmaLinux and Rocky

# show the installed version (php8.4-common for PHP 8.4 on version 10)
rpm -q php-common
# show which module stream is enabled (marked [e])
dnf module list php
# install the update
sudo dnf upgrade 'php*'
# restart
sudo systemctl restart php-fpm
sudo systemctl restart httpd

Use rpm -q, not php -v. Backported builds keep older upstream numbers.

Alpine Linux

On 2026-10-22 the Alpine security database had no fix entry for php83 and php84 in v3.21. The v3.21 community repository already ships php83 8.3.36-r0, a fixed upstream release. Its php84 8.4.14-r0 is still vulnerable. Alpine's data lists GHSA-7875-c8px-7q5f for CVE-2026-109619. PHP's own advisory ID is GHSA-6wmf-4rv5-p3rp.

# show installed PHP packages
apk info -v | grep '^php'
# install the update
apk update && apk upgrade
# restart PHP-FPM (use your branch)
rc-service php-fpm83 restart

In a container, rebuild the image and recreate the container instead (our advice).

Restart every PHP process

Restart Apache, every PHP-FPM pool and any long-running PHP workers after the update (php2shell.com). Then check the running version again. See how to check your PHP version and the full after-update list.

Check your site

The php2shell.fyi checker reads the version number your site sends. A distribution build often reports an old number such as 8.3.6, so confirm the package version on the server.

Sources

• Ubuntu: USN-8948-1
• Ubuntu: USN-8948-2
• Ubuntu: CVE-2026-109618
• Ubuntu: CVE-2026-109619
• Ubuntu: release cycle
• Debian: CVE-2026-109618
• Debian: CVE-2026-109619
• Red Hat: RHSB-2026-013
• Red Hat: CVE-2026-109618
• Red Hat: CVE-2026-109619
• Red Hat: VEX data for CVE-2026-109618
• Red Hat: VEX data for CVE-2026-109619
• AlmaLinux: patched PHP packages released, 2026-10-21
• AlmaLinux: errata
• Rocky Linux: RLSA-2026:87070 (other RLSAs linked in the table)
• Alpine: security database v3.24 (other releases linked in the table)
• php.net: Security advisory, 21 October 2026
• php2shell.com: research site