---
name: php2shell-fix
description: Find and fix PHP2Shell (CVE-2026-109618/109619) in PHP on a server or repo.
---

Use when: the user asks about PHP2Shell or either CVE, or about updating PHP on a server or in a repository you can access.

1. Inventory every PHP runtime, one command at a time:
   php -v
   ls /usr/sbin/php-fpm*   (then php-fpmX.Y -v for each)
   apache2ctl -M | grep php
   ls -d /usr/local/lsws/lsphp*
   php-cgi -v
   frankenphp version
   ls -d /opt/cpanel/ea-php* /opt/plesk/php/* /opt/remi/php*
   docker ps
   In the repository root: grep -rn '^FROM' --include='Dockerfile*' .
2. Packages:
   dpkg -l 'php*' | grep '^ii'
   rpm -qa 'php*'
   apk info -v | grep '^php'
3. Fixed: 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later in the branch. 8.1 and older: vendor backport or a supported branch. Distribution builds: https://php2shell.fyi/linux
4. Plan the update and ask before any change. Take a backup, then restart every PHP worker (lsphp too) and rebuild container images.
5. Verify: versions and packages again, PHP process start times (ps -eo pid,lstart,cmd) after the update, and curl -sIL <site> | grep -i powered
6. Report: runtime, path, version, package, status. Leave secrets and environment values out.

Never without approval: installs, removals, restarts, config edits, files in the web root, deleting files. Never: exploit probes. A version you cannot verify is unknown.
Source: https://www.php.net/archive/2026.php#2026-10-21-5