How to patch PHP2Shell on RHEL, AlmaLinux and Rocky Linux

Before you start

You need root or sudo, a recent backup or snapshot, and a quiet moment — restarting PHP drops requests in flight. These steps apply to Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, Oracle Linux and CentOS Stream; older systems that use yum take the same commands with yum in place of dnf.

Like other distributions, the RHEL family backports fixes into the PHP version it ships, so the version number may not reach 8.3.36 or similar. Trust the advisory and changelog.

1. Find your PHP packages and their source

rpm -qa 'php*' | sort
dnf info php-common | grep -E 'Version|Release|From repo'
dnf module list --enabled php 2>/dev/null

• From repo: appstream (or rhel-*-appstream-rpms) — your distribution maintains PHP and ships backported fixes.
• From repo: remi-* — packages from Remi Collet’s volunteer-run repository. At the time of disclosure it had no updated packages available, and users were advised to switch to distribution packages or build from source. Check again before you upgrade — if a fixed Remi build still isn’t listed, plan a move to the AppStream module stream for your PHP version.

2. Check that a fix is available

dnf updateinfo list --cve CVE-2026-109618
dnf updateinfo list --cve CVE-2026-109619

An advisory ID in the output means an update is available for your system. Empty output can mean you’re already updated — or that your vendor hasn’t shipped yet; the Red Hat CVE page and your distribution’s errata list show the status per release.

3. Upgrade PHP

sudo dnf upgrade 'php*'

Or apply only security updates:

sudo dnf upgrade --security

4. Confirm the fix is in the package

rpm -q --changelog php-common | grep -E 'CVE-2026-10961(8|9)'

Both CVE IDs should appear.

5. Restart PHP and the web server

sudo systemctl restart php-fpm
sudo systemctl restart httpd      # needed for mod_php, harmless otherwise

Using Nginx with PHP-FPM? Restarting php-fpm is enough.

6. Verify

systemctl status php-fpm | grep Active      # started after the upgrade?
/usr/sbin/php-fpm -v

For a one-line verdict on the binary that serves your site:

npx php2shell-checker@latest --local --php /usr/sbin/php-fpm

On distribution packages a version-only check can say VULNERABLE even after a backported fix — the changelog in step 4 is the authority.

Old and end-of-life releases

• RHEL 7 / CentOS 7 are past their regular maintenance. Red Hat Extended Life Cycle Support customers should follow Red Hat’s advisory; everyone else should treat PHP2Shell as the deadline to migrate.
• Software Collections (rh-php*) builds are long out of support — move to a supported PHP version.

After patching

Exploitation attempts started on 17 October 2026, before the fix was public. Work through the compromise checklist and rotate secrets your PHP applications hold.

Short on time? We’ll patch it for you.