Nextcloud and PHP2Shell

Nextcloud runs on PHP, and PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), so a Nextcloud update alone does not fix it. You need to update the PHP that runs your Nextcloud.

Last reviewed 22 October 2026. Rules of 22 October 2026.

What fixes it

A PHP update. Updating Nextcloud or its apps does not update PHP, unless your install ships its own PHP, as AIO and Docker images do.
The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
On Nextcloud AIO, update AIO to v14.4.1 or later.
On Docker, pull the new image and recreate the container.

See your PHP version in Nextcloud

Log in to Nextcloud as an administrator.
Go to Administration settings › System.
For the full PHP information, turn on the Show phpinfo button with this occ command, then reload the page:

./occ config:app:set --value=yes serverinfo phpinfo

Turn the button off again once you have the version. The Nextcloud manual treats exposed phpinfo data as a security risk.

./occ config:app:set --value=no serverinfo phpinfo

The manual also notes that the command-line PHP is not always the same version and configuration as the web server’s PHP. Check the version inside Nextcloud.

Which PHP release to install

PHP ranges from the Nextcloud 35 and 34 Administration Manuals. Fixed releases from php.net.
Nextcloud	Supported PHP	Fixed PHP to install
35	8.3, 8.4, 8.5 (8.5 recommended)	8.5.12, 8.4.27 or 8.3.36
34	8.2 (deprecated), 8.3, 8.4, 8.5 (8.5 recommended)	8.5.12, 8.4.27, 8.3.36 or 8.2.35

For other Nextcloud versions, open the system requirements page in the Administration Manual for your version, and pick the fixed release on a supported branch.

Nextcloud All-in-One (AIO)

AIO ships its own PHP inside its containers. The AIO project released v14.4.1 on 21 October 2026. Its release notes say it ships updated PHP dependencies for PHP CVEs and includes Nextcloud 34.0.5, and they ask users to upgrade as soon as possible. They do not name the PHP2Shell CVEs or a PHP version. We read this release as carrying the fix, but confirm the PHP version after the update.

Update AIO to v14.4.1 or later.
Then check the PHP version in Administration settings › System.

Docker and other container images

Our advice for container installs:

Pull the updated image and recreate the container. A restart alone keeps the old image and the old PHP.
If you build your own image, rebuild it on an updated base image.
After the update, check the PHP version inside Nextcloud.

Other installs

On shared hosting, your host updates PHP. See cPanel, Plesk and shared hosting for what to ask.
On your own server, install the PHP update from your OS vendor or PHP package source. Some vendors put the fix into older PHP builds and keep the old version number.

After the update

Restart PHP-FPM, Apache and every other PHP process. Old processes keep running the old PHP.
If you set memory_limit = -1 as a stopgap, set a finite limit again.
According to php2shell.com, memory disclosure can expose passwords, API keys and other secrets, even without code execution. If your server ran an affected PHP, change the passwords and keys it stores.

Technical notes

php.net says every PHP install that serves web requests is at risk. It names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php as the highest risk, because a shown exploit runs before any application code.
Remote code execution through PHP-FPM was confirmed for CVE-2026-109619, given a suitable application operation. So nginx with PHP-FPM needs the update too.
If your web server passes PHP_VALUE or PHP_ADMIN_VALUE to PHP-FPM, a value that triggers a warning or deprecation (even if it is not shown or logged) adds exposure to CVE-2026-109619. FPM pool settings and .user.ini do not.
The researchers published attacks on WordPress, Drupal and Joomla, and none for Nextcloud. The risk is no lower for that, because the flaw is in PHP.
No configuration setting fully replaces the update. For interim steps, see Mitigations.

Sources

Check your site

Our checker reads the public response of your Nextcloud and reports any PHP version it can see. Check my site.