How to patch PHP2Shell on your server
Pick your platform. Every guide follows the same three steps: find the PHP that serves your site, upgrade it to a fixed release, then restart and verify. If you’re not sure which PHP you run, start with how to check your PHP version.
Ubuntu & Debian
Fix CVE-2026-109618 and CVE-2026-109619 on Ubuntu or Debian: find your PHP packages, upgrade, confirm the fix in the changelog, restart PHP-FPM or Apache, verify.
Open guide →RHEL, Alma & Rocky
Fix CVE-2026-109618 and CVE-2026-109619 on RHEL, AlmaLinux, Rocky or CentOS Stream: check advisories with dnf, upgrade PHP, restart php-fpm and httpd, verify.
Open guide →Docker & Kubernetes
Fix CVE-2026-109618 and CVE-2026-109619 in containers: find PHP versions in running containers, rebuild on a patched php base image, redeploy and verify.
Open guide →cPanel & WHM
Fix CVE-2026-109618 and CVE-2026-109619 on cPanel/WHM: check ea-php versions, update EasyApache 4, CloudLinux alt-php and LiteSpeed lsphp packages, restart and verify.
Open guide →WordPress sites
Updating WordPress won't fix PHP2Shell. Check your site's PHP version in Site Health, ask your host to patch (email template), then clean up and rotate secrets.
Open guide →Laravel apps
Laravel apps need a PHP upgrade, not a Laravel update, to fix PHP2Shell. Patch on Forge, Docker or your own server, restart Octane and queues, and rotate APP_KEY safely.
Open guide →Can’t patch today?
Interim mitigations reduce exposure while you schedule the upgrade. They are not a fix.
Rather not do it yourself?
We’ll upgrade PHP on one server, restart it properly and confirm the fix is live — from €79.