PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pre-auth remote code execution bug in PHP itself, so every WordPress box needs attention today. Here’s the checklist I’d run on a Debian or Ubuntu web server. Swap in your own versions and service names.
1. Take a snapshot first
Take a provider snapshot or backup of the server before you touch packages. If an update breaks a plugin, you want a one-click way back.
2. Find every PHP on the box
php -v
ls /etc/php/ # every installed PHP branch
dpkg -l | grep -E '^ii\s+(php|libapache2-mod-php)'
systemctl list-units --type=service | grep -Ei 'php|apache|nginx|litespeed'
docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null # PHP hiding in containers?Don’t forget the CLI, old branches left behind after an upgrade, and containers. PHP is often bundled inside other software.
3. Update
sudo apt update
apt list --upgradable 2>/dev/null | grep -i php
sudo apt install --only-upgrade 'php*' 'libapache2-mod-php*'Distro builds keep their own version numbers and backport the fixes, so check the changelog for the CVE instead of looking for 8.3.36:
apt changelog php8.3-fpm 2>/dev/null | grep -m3 -E 'CVE-2026-10961[89]'Using official images or building from source? Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
4. Restart every worker
A reload isn’t enough, because stale workers keep the old code in memory.
sudo systemctl restart php8.3-fpm # each FPM version you have
sudo systemctl restart apache2 # if you use mod_php
sudo systemctl restart nginx5. Can’t patch right now? Reduce exposure
These measures from the PHP advisory are partial and not a fix. Put them in php.ini or the FPM pool, not ini_set() or .user.ini:
; /etc/php/8.3/fpm/conf.d/99-php2shell.ini
session.upload_progress.enabled = 0
post_max_size = 32M ; 8M if you don't need uploads
upload_max_filesize = 24M ; keep below post_max_size
; PHP 8.5 only:
; fatal_error_backtraces = 0WordPress media uploads need room, so 32M is a sane middle ground for most blogs.
6. Verify and watch
php -v
sudo ps -eo pid,lstart,cmd | grep -E 'php-fpm|apache2' | grep -v grep # start times should be after the update
sudo ps -ef --forest | grep -A2 php-fpm | grep -E 'sh -c|bash|curl|wget' # workers spawning shells = bad signThen load your site, log in to wp-admin and make sure everything works. If you’re on PHP 8.1 or older, CISA says to take it offline until it’s upgraded. If you’re stuck there, this is your sign to move up.
Have a blessed day! And Happy Hacking!
