PHP2Shell.fyi Check a site

PHP2Shell on Debian

Debian fixes PHP2Shell in php8.4 on Debian 13 and php8.2 on Debian 12. Both fixed packages carry the fixed upstream release, 8.4.27 and 8.2.35. Install them from the security archive, then restart PHP.

Last reviewed . Rules of .

Fixed packages

Source: Debian security tracker, CVE-2026-109618, CVE-2026-109619, DSA-6574-1 and DLA-4848-1. Checked 2026-10-22.
ReleasePackageFixed versionAdvisory
13 trixiephp8.48.4.27-1~deb13u1DSA-6574-1. The point-release version 8.4.24-1~deb13u1 is vulnerable.
12 bookworm (LTS)php8.28.2.35-1~deb12u1DLA-4848-1. The point-release version 8.2.32-1~deb12u1 is vulnerable.
unstable (sid)php8.48.4.27-1Debian bug 1151516.
unstable (sid)php8.2unfixedThe tracker lists php8.2 in unstable as unfixed.
testing (forky)php8.4pendingTesting still ships 8.4.26-1, which is vulnerable.

The tracker has no row for Debian 11 bullseye. If you still run it, ask your support vendor or upgrade the release.

The fixes come from the security archive. Make sure your sources include trixie-security or bookworm-security.

See the installed build

# every installed PHP package and its version
    dpkg -l 'php*' 'libapache2-mod-php*' | grep '^ii'
    # installed and candidate version, and where it comes from
    apt policy php8.4-fpm

Use your branch in the package name: php8.4 on Debian 13, php8.2 on Debian 12. Read the Installed: line. If it is lower than the table, the fix is missing.

If apt policy shows a source other than a Debian archive, for example a third-party repository, the table does not apply. Compare that PHP with the fixed releases.

Install the update

sudo apt update
    # only the PHP packages that are installed (use your branch)
    sudo apt install --only-upgrade php8.4-fpm php8.4-cli php8.4-cgi libapache2-mod-php8.4
    # or everything
    sudo apt upgrade

Restart PHP

sudo systemctl restart php8.4-fpm
    # Apache with mod_php, or Apache in front of PHP-FPM
    sudo systemctl restart apache2

A running PHP process keeps the old code in memory until it stops. Restart Apache, every PHP-FPM pool and any long-running PHP workers, such as queue workers (php2shell.com). In a container, rebuild the image and recreate the container (our advice).

To see that PHP-FPM started after the update (our advice):

zgrep ' upgrade php8.4-fpm' /var/log/dpkg.log*
    systemctl show -p ActiveEnterTimestamp php8.4-fpm

php -v is not the web server's PHP

ls /run/php/ lists the PHP-FPM sockets. apache2ctl -M | grep php shows whether Apache loads mod_php. A short phpinfo() test shows the version and the Server API.

Check your site

The php2shell.fyi checker reads the PHP version your site shows in public. A header is a hint, not proof. A distribution build often reports an old number, so confirm the package version on the server. A result never proves that a site is not exposed.

Sources