Patch your PHP installation: the PHP2Shell vulnerabilities are fixed in current releases of PHP 8.2 through 8.5, and distributions including Red Hat Enterprise Linux 8, 9, and 10 have shipped backported packages. For systems stuck on end-of-life platforms such as RHEL 7, no vendor fix exists, so you must apply configuration-level mitigations, rebuild from patched sources, or migrate to a supported release.
What PHP2Shell actually is
PHP2Shell is not a single bug but a chain combining two core PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, with a severity reaching CVSS 9.2. Together they permit unauthenticated attackers to execute arbitrary code or leak sensitive process memory on vulnerable servers. Because PHP runs on roughly seventy percent of web servers, and because WordPress, Drupal, and MediaWiki all depend on it, the practical exposure is enormous.
The two flaws behave differently, which matters for mitigation:
- CVE-2026-109619 involves the session upload progress feature and multipart request handling. Disabling
session.upload_progressremoves one exploitation path. - CVE-2026-109618 is a separate memory corruption in request handling that configuration alone does not close. Only patched code addresses it.
Red Hat has published its response as RHSB-2026-013, confirming that RHEL 7, 8, 9, and 10 are affected, with RHEL 7 impacted by the upload-progress flaw specifically.
Patched PHP versions if you manage PHP yourself
If you install PHP from php.net or a repository tracking upstream versions, update to at least the following releases:
- PHP 8.2: 8.2.35 or newer
- PHP 8.3: 8.3.36 or newer
- PHP 8.4: 8.4.27 or newer
- PHP 8.5: 8.5.12 or newer
Older branches such as 5.6 through 8.1 no longer receive upstream binary releases, which is exactly why legacy servers are the hard part of this incident.
RHEL 8 and 9: the straightforward case
Both releases are still supported, so the vendor fix arrives through the normal update channels. If your PHP comes from the base repositories, run:
sudo dnf upgrade 'php*'If you use the Remi repository to track newer PHP versions, a general update picks up the patched packages:
sudo dnf updateTo confirm the fix actually landed rather than trusting a version string, query the advisory directly:
dnf updateinfo list --cve CVE-2026-109618Then restart your web server or PHP-FPM pool so the new binaries are loaded:
sudo systemctl restart php-fpm
sudo systemctl restart httpdRHEL 7: the hard case
RHEL 7 is past its supported lifetime, and neither php.net nor the Remi repository ships fixed binaries for it. You have three realistic options, in increasing order of effort:
1. Apply the configuration stopgap
Create a drop-in file such as /etc/php.d/99-php2shell.ini containing:
session.upload_progress.enabled = 0
max_file_uploads = 20Restart Apache or PHP-FPM afterward. Be clear about what this does and does not do: it closes the upload-progress route into CVE-2026-109619 but leaves CVE-2026-109618 open. Treat it as a temporary measure while you arrange a real fix, not a substitute for patching.
2. Switch to a third-party repository shipping fixed builds
Some vendors rebuild Remi's EL7 PHP packages (from 5.6 up to 8.4) with the security fixes backported, under the same package names, so the change is an in-place upgrade rather than a migration. Verify licensing terms before using such repositories in production.
3. Rebuild the source RPMs yourself
You can run rpmbuild --rebuild against Remi's source RPMs after applying the community-maintained C patches for main/rfc1867.c and ext/session/session.c, which are tracked in public patch collections. This works but demands ongoing maintenance: every future security fix on that EOL branch becomes your responsibility.
Why php -v cannot tell you whether you are safe
A common trap with backported fixes is that distributions patch the code without changing the upstream version number. An Ubuntu 24.04 system, for example, may report PHP 8.3.6 even though package revision -0ubuntu0.24.04.13 carries the fix. On Debian and Ubuntu, the supported releases (22.04, 24.04, 26.04, and current interim releases) received the fix through the normal security pocket:
sudo apt update
sudo apt upgradeUbuntu releases outside standard support only get the fix with a paid Ubuntu Pro subscription (or similar extended-security offering). On RPM systems, use dnf updateinfo keyed to the CVE instead of the version string. Automated check scripts that inspect package release fields rather than upstream versions are available for auditing fleets.
Verification checklist
- Identify where each server's PHP comes from (base repo, Remi, SCL, third party).
- Apply the vendor update, or the configuration mitigation if no update exists.
- Restart the SAPI (httpd, php-fpm) so old code is unloaded.
- Confirm via
dnf updateinfo, package changelog, or a CVE-specific check script. - Scan for other unpatched PHP instances, including containers and legacy cron-driven CLI scripts.
Longer-term prevention
This incident is a reminder that running PHP on an end-of-life operating system converts every upstream emergency into your personal fire drill. Build migration schedules into your infrastructure planning so that when the next CVSS 9+ PHP flaw appears, your answer is "run the update" rather than "rebuild source RPMs at midnight."
Frequently Asked Questions
Is disabling session upload progress a complete fix?
No. It blocks one exploitation path for CVE-2026-109619 but does nothing about CVE-2026-109618. Use it only as a stopgap on systems you cannot patch immediately.
Which exact PHP versions include the fix?
At minimum 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Distro packages may carry lower version numbers with the fix backported, so verify by package revision or advisory, not by php -v.
Does RHEL 7 get an official patch?
No. Red Hat acknowledges RHEL 7 is affected (by CVE-2026-109619) but the platform is out of support. You need a third-party rebuild, a self-built patched package, or migration.
How do I check whether my RHEL 8 or 9 system is fixed?
Run dnf updateinfo list --cve CVE-2026-109618. If no pending advisory appears for your installed PHP packages after updating, the fix is in place.
Do I need to restart anything after patching?
Yes. Restart httpd and/or php-fpm so that the patched shared libraries are actually loaded; an updated package alone does not protect running processes.