How to Patch PHP2Shell on AlmaLinux, Rocky Linux and RHEL (Modules and Remi)

On AlmaLinux, Rocky Linux and RHEL, the first question is not how to update PHP but where your PHP comes from. It might be the distribution's own module stream, a repository such as Remi, or a build supplied by a control panel. Each is patched on its own schedule, and updating the wrong one leaves the interpreter your sites use untouched. This guide helps you identify the source, update it and prove the result. For background on the flaws, see our overview of PHP2Shell, CVE-2026-109618 and CVE-2026-109619.

Find out where your PHP comes from

rpm -qa | grep -E "^php[0-9.-]*(-fpm|-cli|-common)?-?[0-9]"
dnf module list --enabled php
dnf repoquery --installed --qf '%{name} %{from_repo}' 'php*' 2>/dev/null | head

The module list shows whether you use a distribution stream. Packages with prefixes like php83-php-fpm come from Remi. Anything under /opt/cpanel or /opt/plesk belongs to a control panel and follows its own guide: cPanel and CloudLinux or Plesk.

Update distribution PHP

sudo dnf clean all
sudo dnf upgrade 'php*'
rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961[89]'

Distribution errata can arrive after upstream releases, so if nothing is offered yet, run dnf check-update 'php*' again later and check the AlmaLinux or Rocky announcements. Do not assume a clean dnf upgrade means you are safe: only the changelog containing the CVE identifiers confirms the fix.

Watch the module stream trap

On RHEL 8-family systems, a bare dnf install php can pull the retired 7.2 stream, which receives no fixes. If you are on an old stream, switching is a major version change and must be tested:

sudo dnf module reset php
sudo dnf module enable php:8.2
sudo dnf distro-sync

Test your applications on a staging copy first. Do not run this on a production server in a hurry.

Update Remi PHP

Remi builds can lag the day of release. When they appear, update the versions you use, adjusting the number:

sudo dnf upgrade 'php84-*'
sudo systemctl restart php84-php-fpm

If the fix is not there yet, the safe choice is to wait for it, not to compile your own build in a panic. Check again through the day.

Restart PHP and the web server

sudo systemctl restart php-fpm
sudo systemctl restart httpd

Use the Remi service name for Remi builds. Restart queue workers and long-running scripts too, since they keep the old code in memory. sudo needs-restarting -s lists services still running outdated libraries.

Retire old PHP versions

PHP 8.1 and older no longer receive official releases. If you still run them, move to a supported branch such as 8.3 or 8.4. Our Linux server maintenance checklist keeps patching routine, and if package updates fail with metadata errors, see AlmaLinux dnf: failed to download metadata for repo.

If the server was unpatched for days, follow how to check whether PHP2Shell hit your server.

If you want it done for you, contact us. Our AlmaLinux server management engineers will identify every PHP source, update it, restart the right services and verify the fix.