How to Patch PHP2Shell on Ubuntu and Debian (Fixed Versions and Commands)

On Ubuntu and Debian the PHP2Shell fix usually arrives as an ordinary package update, which is good news. The catch is that distributions backport the fix into the version you already run, so php -v keeps printing the old number even when you are fully patched. This guide gives the fixed package versions, the commands, and a check that does not depend on the version string. For the background, read our overview of PHP2Shell, CVE-2026-109618 and CVE-2026-109619.

Fixed package versions on Ubuntu

According to Ubuntu's announcement, the fixed packages are:

Ubuntu 20.04 and 18.04 are covered only through Ubuntu Pro (ESM), and older releases need the Legacy add-on. On those, sudo pro fix CVE-2026-109618 applies the fix once the machine is attached.

Debian and the third-party repositories

Debian 13 lists php8.4 at 8.4.27-1~deb13u1, and Debian 12 php8.2 at 8.2.35-1~deb12u1 through the LTS channel. Debian 11 has no free fix because its LTS support ended, so the choices are a source backport, a paid extended-support service, or upgrading the release. If you use packages.sury.org or the Launchpad PPA from Ondrej Sury for newer branches, note they did not always update at the same moment, so check what your repository actually offers before assuming it is behind.

Update the packages

Updating everything is the simplest and the one Ubuntu recommends. To touch only PHP:

sudo apt update
apt list --upgradable 2>/dev/null | grep -i php
sudo apt install --only-upgrade 'php8.3*' libapache2-mod-php8.3

Replace 8.3 with the versions you run. If no new build appears, check apt-cache policy php8.3-fpm for mirror lag and try again shortly. Unattended upgrades may already have installed the update, but they do not restart your services.

Restart what runs PHP

A package update does not replace code already loaded in memory. Restart each service that serves PHP:

sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2

Use a full restart for Apache with mod_php, since a graceful reload does not load the new module. Restart queue workers and supervised jobs as well. To find processes still mapping replaced libraries, run sudo needrestart -b -r l.

Prove the fix with the changelog

zgrep -E 'CVE-2026-10961[89]' /usr/share/doc/php8.3-fpm/changelog.Debian.gz
dpkg -l | grep -E '^ii\s+php8'

If the CVE identifiers appear, the fix is installed. Packages from the Sury repository may only say "new upstream version", so compare the installed version against the fixed upstream release, 8.4.27, 8.3.36 or 8.2.35, instead.

Multiple PHP versions

Servers that carry several versions side by side, common with Plesk, need every one updated and restarted. Our guide for Plesk servers covers the mixed case. If the machine was exposed before you patched, follow how to check whether PHP2Shell hit your server, and keep the routine in our Linux server maintenance checklist so the next update is not an emergency.

If you want an engineer to do this, contact us. Our Ubuntu server management team will update and restart PHP on each server, verify against the changelog and check for compromise.