How to Update PHP for PHP2Shell on a Server You Run: Ubuntu, Debian, RHEL, Windows, XAMPP, AppServ and Docker How to update PHP for PHP2Shell on Ubuntu, Debian, RHEL, Windows, XAMPP and Docker: official commands, fix dates, restarts and checks. AppServ has no fix.
How to Update PHP for PHP2Shell on a Server You Run: Ubuntu, Debian, RHEL, Windows, XAMPP, AppServ and Docker
On October 21, 2026, PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix the pair of flaws known as PHP2Shell (details of the flaws ). This guide covers servers you manage yourself, platform by platform.
Short answer: update through the same channel PHP came from, set the needed configuration, restart PHP-FPM or Apache so the new binary loads, then compare the installed package with the advisory. Most sources had a fixed build between October 21 and 23, but availability depends on the exact package source and branch. Examples with no fixed build include XAMPP on Linux/macOS, AppServ and the Docker images for 8.1/8.0. Hosts without a fix should not be reachable from the internet.
If you don't know which PHP each host runs, start with checking the PHP version each site really runs . cPanel or Plesk users should read the hosting panel guide , and appliances are covered in products that bundle PHP .
Fixed-build status as of October 25, 2026
A snapshot as of October 25 (dates in UTC). Where the latest linked vendor advisory or tracker says otherwise, the vendor wins.
Platform Fixed build available? What the version looks like Ubuntu 22.04 / 24.04 / 26.04 Yes, USN-8948-1 (Oct 21) Distro numbering, e.g. 8.3.6-0ubuntu0.24.04.13 on 24.04 Ubuntu 14.04–20.04 Ubuntu Pro only, USN-8948-2 (Oct 21) Per the USN Debian 12 / 13 Yes, DSA-6574-1 (Oct 21) and DLA-4848-1 (tracker ) 8.2.35-1~deb12u1, 8.4.27-1~deb13u1ondrej/php PPA , packages.sury.org Yes (Oct 21) Upstream numbers RHEL 8 / 9 / 10 Most streams, RHSA (Oct 21) php:8.4 on 9 still AffectedAlmaLinux 8 / 9 / 10 Streams in the announcement (Oct 21) Below upstream, ending .alma.1 Rocky Linux 8 / 9 / 10 Yes, RLSA (Oct 22) No RLSA found for php:8.4 on 9 Remi (EL 8 and later) Yes, Remi's post (Oct 22) Upstream numbers Windows (php.net zips) Yes, windows.php.net (Oct 21) 8.2.35, 8.3.36, 8.4.27, 8.5.12 XAMPP for Windows 8.3.36, 8.4.27, 8.5.12 (Apache Friends , Oct 23) No 8.2.35 build XAMPP for Linux No (SourceForge ) Newest is 8.2.12 (2023) XAMPP for macOS No (SourceForge ) Newest download is 8.2.4 AppServ No (appserv.org ) 9.3.0 ships PHP 7.3.10 (2019) Official Docker php image Tags 8.2.35, 8.3.36, 8.4.27, 8.5.12 (Docker Hub ) None for 8.1 or 8.0
A low number doesn't mean unpatched: Ubuntu and AlmaLinux put the fix into their existing version numbers.
1. Before you restart: set the configuration
Make these changes in php.ini, the FPM pool or the server configuration before the restart steps below (php.net says not to rely on ini_set() or .user.ini). After restarting, Sophos advises checking the effective values from a live web request rather than the CLI; do it through an access-controlled page and never expose phpinfo() publicly.
session.upload_progress.enabled=0.memory_limit-1. Sansec, a third party, advises returning to a finite limit. GHSA-w8hw-w9fx-j79w says the fix adds a hard OOM via _exit().
2. Ubuntu and Debian
Update from the distro. Ubuntu's About CVEs page says this command upgrades all installed packages; it needs sudo, and Ubuntu recommends against cherry-picking individual packages:
sudo apt update && sudo apt upgrade
Debian's Security FAQ likewise gives apt-get update and then apt-get upgrade (as root), which also upgrades every package.
If the package version contains deb.sury.org , PHP comes from Ondřej Surý's repositories. Both the PPA (Ubuntu 22.04, 24.04) and packages.sury.org (Debian 12, 13) have had 8.2.35, 8.3.36, 8.4.27 and 8.5.12 since October 21, and the commands above pick them up. New 8.1, 8.0 and 7.4 builds from the same place exist, but no official page confirms they carry the CVE fixes; see the legacy PHP guide , which also covers Ubuntu 14.04–20.04.
Restart. ThaiCERT says to restart the PHP workers and the related web server after updating so the fixed binary loads: Apache if you use mod_php, and that version's PHP-FPM service if you use FPM. Use restart rather than reload: the PHP manual doesn't say a reload loads an upgraded binary.
Confirm. dpkg-query -W 'php*' 'libapache2-mod-php*' lists PHP packages with their installed versions; compare them with the same package names in the USN or Debian tracker, then check the web side.
3. RHEL, AlmaLinux and Rocky Linux: AppStream and Remi
RHEL. The October 21 RHSAs cover the AppStream PHP packages on RHEL 8, 9 and 10 for most streams, except the RHEL 9 php:8.4 module, still Affected on October 25. Red Hat's article linked from every RHSA gives dnf upgrade on RHEL 9 and dnf update on RHEL 8, which update the whole system and need root.
AlmaLinux. AlmaLinux's announcement gives:
sudo dnf clean metadata && sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm
With mod_php on AlmaLinux 8, run sudo systemctl restart httpd instead.
Rocky Linux published RLSAs matching the RHSA numbers on October 22 for Rocky 8, 9 and 10. As of October 25 we found no RLSA for php:8.4 on Rocky 9, and AlmaLinux's announcement does not list php:8.4 for AlmaLinux 9, so that stream's status is unconfirmed; ask your package vendor (Remi's PHP 8.4 has the fixed 8.4.27).
Remi published all four versions in remi-modular on October 22. Its post gives dnf module switch-to php:remi-8.4/common (Remi's 8.4 in place of the default PHP) or yum install php84 (a parallel SCL).
Confirm. Compare rpm -q php-common (or php8.4-common for PHP 8.4 on 10) with the same package name in the AlmaLinux announcement, RHSA or RLSA, then check the web side.
4. Windows and IIS/FastCGI
Download. The php.net Downloads page (Windows) and the releases folder have 8.2.35, 8.3.36, 8.4.27 and 8.5.12 zips dated October 21.Pick the right build. php.net says to use Non Thread Safe (NTS) for PHP as FastCGI with IIS, and Thread Safe (TS) for Apache.IIS. The PHP manual maps .php to php-cgi.exe (not php.exe) through the FastCGI module, so that handler path must point to the new build.Restart. We found no official page on restarting IIS or FastCGI after swapping PHP files, so follow Microsoft's documentation. The outcome you need: no php-cgi.exe from the old build is still running. With Apache, restart the Apache service.Confirm. In PowerShell, run .\php.exe -v in the folder the handler points to, or use the full path (Microsoft's docs: PowerShell won't run a file from the current folder without a path). Then confirm from the web side.
5. XAMPP
If your school, university or office still has machines running XAMPP or AppServ, these two sections matter most.
Windows. Apache Friends lists XAMPP for Windows 8.5.12, 8.4.27 and 8.3.36, dated October 23, but no 8.2.35, so 8.2 users must move to 8.3.36 or later and test their apps first. We found no Apache Friends procedure for upgrading in place, so plan it like a new install (we suggest backing up htdocs and databases first), then confirm from the web side.Linux and macOS. No fixed build. The newest Linux build is 8.2.12 (November 25, 2023), and the newest macOS download is 8.2.4.What to do instead. XAMPP's own FAQ says it "is not meant for production use". If a XAMPP machine is reachable from the internet, ThaiCERT says to consider isolating it or limiting access to approved networks and IP addresses until it is patched. Sites that must stay public belong on a fixed PHP from sections 2–3.
6. AppServ
The latest AppServ is 9.3.0 with PHP 7.3.10, released September 29, 2019. PHP 7.3 reached end of life on December 6, 2021, and PHP's source backports cover only 7.4, 8.0 and 8.1, so PHP offers no fix for 7.3.
Keep AppServ machines unreachable from the internet. CISA says organizations still on PHP 8.1 or earlier should take PHP-based systems offline until they can be patched or updated. Migration options are in the legacy PHP guide .
7. The official Docker php image
docker-library/php merged the four fixed versions on October 21.
Fix FROM. If you pin a patch version, change it to a fixed one such as php:8.3.36-fpm. If you use php:8.3-fpm, that tag now points to the same image as 8.3.36.Rebuild. Docker's docs use docker build --pull -t my-image:my-tag ., which forces a fresh base image.Redeploy. Images are snapshots, so a rebuild doesn't change running containers. ThaiCERT says to deploy new containers and check that the serving ones no longer use the old PHP.Confirm. docker ps --quiet --filter "ancestor=OLD_IMAGE_ID" (substitute the real old image ID) should print nothing. It only checks running containers on that Docker daemon (Docker docs ), so still check every serving replica from the web side.
Limits of this guide
Updating doesn't tell you whether a host was compromised earlier: continue with hunting in your logs and what to do if you may be compromised .
We found no official restart steps for IIS/FastCGI, LiteSpeed or OPcache; follow the vendor's documentation, and make sure no process from the old binary keeps running.
Short checklist
Find where each host gets PHP, and update from that source
Set session.upload_progress.enabled=0, and restore memory_limit if you had set -1, in php.ini or the FPM pool
Fully restart PHP-FPM or Apache; replace containers
Compare the package version with the advisory, then check the version and effective settings from the web side
Take hosts with no fix off the internet
If your host list has outgrown a spreadsheet, compare options and prices on the pricing page .
For the next round, zcrX can track product lifecycle and end-of-life per software product, though it does not replace patching.
Get in touch
Want a second opinion on which hosts to update first? Talk to our team — the consultation is free. zcr provides the software; hands-on work is delivered through channel partners.
Read next
Check the PHP version each site runs · Legacy PHP 7.4/8.0/8.1 · Hosting panels · How far a WAF gets you
Sources
PHP News Archive 2026 — fixed versions (Oct 21), Remi not ready on release day, settings in php.ini/FPM pool/server config rather than ini_set() or .user.ini, 7.4/8.0/8.1 source backports, Oct 23 session upload progress note (CVE-2026-115560)GHSA-w8hw-w9fx-j79w (CVE-2026-109618) — soft OOM and hard OOM via _exit()Ubuntu USN-8948-1 and USN-8948-2 — fixed versions per release, Ubuntu Pro for 14.04–20.04Ubuntu — About CVEs: Getting security updates — sudo apt update && sudo apt upgrade upgrades all installed packagesDebian Security Tracker CVE-2026-109618 and CVE-2026-109619 — fixed versions for bookworm and trixie; Debian Security Information — DSA-6574-1 on Oct 21Debian Security FAQ — apt-get update, apt-get upgrade; dpkg-query(1) — -W prints package name and installed versionLaunchpad — PPA for PHP (ondrej/php) and DEB.SURY.ORG — builds dated Oct 21Red Hat — CVE-2026-109618 , RHSA-2026:87070 and How do I apply package updates to my RHEL system? — fixed streams, RHEL 9 php:8.4 Affected, package list incl. php-common, dnf upgrade/dnf update; rpm(8) — rpm -qAlmaLinux — php2shell: Patched PHP packages released — dnf commands, restart, rpm -q, patched versions per streamRocky Linux Errata — RLSA-2026:87070 (also 87071, 87079, 87072, 87151, 87073, 87080) — published Oct 22, package listsRemi's RPM repository — PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — Oct 22, dnf module switch-to, yum install php84PHP for Windows — Downloads and releases — Oct 21 builds, NTS for IIS, TS for ApachePHP Manual — Installation with IIS for Windows and Command line options — php-cgi.exe handler mapping, -v; Microsoft — about_Command_Precedence — use .\ or the full pathApache Friends — Download XAMPP , SourceForge XAMPP Windows , XAMPP Linux and all files — Oct 23 builds, newest Linux build 8.2.12, newest macOS download 8.2.4XAMPP Linux FAQ , Windows FAQ and OS X FAQ — "not meant for production use"AppServ — Download — 9.3.0, PHP 7.3.10, 2019-09-29PHP — Unsupported Branches — PHP 7.3 end of life Dec 6, 2021docker-library/php PR #1694 , Docker Hub — php and Docker — Building best practices — fixed tags, docker build --pull, images as snapshotsDocker — docker container ls — --quiet, the ancestor filter, running containers only by defaultThaiCERT — PHP2Shell advisory (Oct 22, 2026, Thai) — items 3.5 (restart), 3.6 (containers), 4.7 (isolate from the internet)CISA — Critical Vulnerabilities in PHP Require Immediate Patching — take PHP 8.1 or earlier offline until patchedSophos — PHP2Shell advisory — verify effective settings from a live web request, not the CLISansec — PHP2Shell — third-party advice on restoring memory_limit Products | Pricing | Resources | Insights | Contact 