Canonical has issued emergency security updates across all supported Ubuntu releases to address "php2shell", a pair of critical unauthenticated remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Scoring 9.2 on the CVSS scale, these flaws allow remote attackers to execute arbitrary system code without authentication. Linux system administrators should inspect their installed PHP runtime packages and upgrade immediately using standard APT package management tools.
Understanding php2shell: The Threat Profile
The vulnerabilities collectively dubbed "php2shell" represent an urgent threat to web infrastructure running on Ubuntu. Assigned common vulnerability identifiers CVE-2026-109618 and CVE-2026-109619, both flaws carry a Common Vulnerability Scoring System (CVSS) 4.0 base rating of 9.2 out of 10, designating them as Critical. Unlike flaws requiring local authentication or authenticated administrative rights inside a content management system, php2shell can be triggered over raw network channels by any unauthenticated client sending malicious requests directly to a reachable web endpoint.
Once executed, the exploit hands the attacker arbitrary command execution within the security context of the user process serving the PHP script, typically www-data on standard Nginx and Apache installations. While privilege boundaries prevent immediate system-level kernel control, an unauthenticated shell inside the web server root allows attackers to read database connection strings from configuration files, alter persistent storage, exfiltrate user records, and stage secondary privilege escalation scripts against the host operating system.
According to Canonical's official release announcement, the PHP Foundation initially coordinated disclosure schedules with major Linux distribution maintainers for October 22, 2026. However, an unauthorized leak in the wild forced the security coordination team to move the disclosure timeline forward by twenty-four hours to October 21. Canonical security engineers immediately pushed patched packages across all active archives, ensuring production servers have verified paths to safety.
Affected Ubuntu Distributions and Patched Releases
Because PHP forms the backbone of countless enterprise production stacks, Canonical backported fixes across both standard LTS maintenance channels and extended enterprise legacy branches (Expanded Security Maintenance). Standard support tracks cover Ubuntu 24.04 LTS (Noble Numbat) and Ubuntu 22.04 LTS (Jammy Jellyfish), alongside rolling releases and legacy LTS branches dating back to Ubuntu 14.04 LTS (Trusty Tahr).
Review the remediation table below to identify your specific distribution branch, the relevant base package name, and the minimum package version required to neutralize both CVEs:
| Ubuntu Release | Package Base | Remediated Package Version | Channel Tier |
|---|---|---|---|
| 14.04 LTS (Trusty) | php5 |
5.5.9+dfsg-1ubuntu4.29+esm18 |
Ubuntu Pro (ESM) |
| 16.04 LTS (Xenial) | php7.0 |
7.0.33-0ubuntu0.16.04.16+esm22 |
Ubuntu Pro (ESM) |
| 18.04 LTS (Bionic) | php7.2 |
7.2.24-0ubuntu0.18.04.17+esm14 |
Ubuntu Pro (ESM) |
| 20.04 LTS (Focal) | php7.4 |
7.4.3-4ubuntu2.29+esm5 |
Ubuntu Pro (ESM) |
| 22.04 LTS (Jammy) | php8.1 |
8.1.2-1ubuntu2.28 |
Standard Security Archive |
| 24.04 LTS (Noble) | php8.3 |
8.3.6-0ubuntu0.24.04.13 |
Standard Security Archive |
| 26.04 LTS (Resolute) | php8.5 |
8.5.4-0ubuntu1.5 |
Standard Security Archive |
| 26.10 (Stonking) | php8.5 |
8.5.9-0ubuntu2.1 |
Standard Security Archive |
Auditing Your System for Vulnerable Packages
Before executing batch updates across server fleets, determine whether your instances host vulnerable interpreter binaries. Modern APT tools support pattern-matching queries that isolate installed PHP packages without sifting through unrelated build tools or common libraries.
Run the following pattern check inside your terminal:
apt list '?installed ?name(^php[0-9.]+$)'If your machine runs multiple custom configurations (such as multiple parallel PHP-FPM pools for separate virtual hosts), you can check all active binaries and modules by inspecting the CLI wrapper directly:
php -v
dpkg -l | grep -E 'php[0-9\.]+(-common|-fpm|-cli)'Compare the output against the remediation table above. If the package version listed in your output is lower than the target patch revision, your system remains exposed to unauthenticated exploit payloads.
Step-by-Step Remediation on Ubuntu
Resolving the vulnerability requires fetching the latest metadata from the Ubuntu security repositories and updating the interpreter packages. For production systems where minimal disruption is required, administrators can update only the PHP packages or conduct a comprehensive system upgrade.
Method 1: Targeted Package Upgrades
To upgrade the PHP suite without touching unaffected daemon stacks or triggering broader package migrations, execute the targeted upgrade syntax. Substitute your installed version number (e.g., 8.3 for Ubuntu 24.04 or 8.1 for Ubuntu 22.04):
sudo apt update
sudo apt install --only-upgrade php8.3 php8.3-cli php8.3-fpm php8.3-commonMethod 2: Comprehensive Server Patching
For standalone web servers or instances maintained via automation scripts, applying all available distribution security fixes remains best practice:
sudo apt update && sudo apt dist-upgrade -yPost-Installation Service Verification
Once the upgrade process completes, explicitly restart your web service workers to guarantee that all resident memory spaces load the patched binary interfaces. Determine which process manager handles your web requests and issue the corresponding systemctl restart command:
# For PHP-FPM managed stacks (Nginx or Apache event MPM)
sudo systemctl restart php8.3-fpm
# For mod_php integrated stacks (Apache prefork)
sudo systemctl restart apache2To verify that no running processes remain tied to superseded libraries, use the needrestart utility. This tool queries system memory mappings and confirms that your daemons run against current disk binaries:
sudo needrestart -b | grep -i phpIf the command returns a clean exit code without flagging orphaned PHP libraries, your server is secured against the php2shell exploit vectors. Administrators managing legacy LTS branches (14.04, 16.04, 18.04, or 20.04) should verify that their machines possess valid Ubuntu Pro tokens attached via pro status so the client can pull these patched builds from the ESM repositories.