To quote Wikipedia:
PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, known under Common Vulnerabilities and Exposures IDs CVE-2026-109618 and CVE-2026-109619, that allow remote code execution (RCE). Their existence was publicly announced on 20 October 2026. An emergency patch and details about the vulnerabilities were released on the following day.
These two vulnerabilities both rank as a 9.2 on the ten point CVE scale of risk so definitely Bad News™ for anything running PHP. This blog along with my other two, Geek on a Harley and Words of the AgingGamer, all run on WordPress which runs on PHP. So I dug into the problem today.
My corrective actions
I noticed immediately that my blog server was running a vulnerable PHP version- 8.4.26. My server automatically updates every couple of days but I decided to do a manual run of DNF to see if I could pick up the new version a bit sooner. I had no luck: Fedora, the Linux I run, had not yet released a patched version 8.4.27 correcting the issues. I did some digging and found that Fedora had already updated Fedora release 44 with the PHP patch for 8.5- for some reason they were lagging a bit behind on patching earlier releases, and I’m on Fedora 43. Of course I am.
So I upgraded to Fedora release 44 and checked the PHP version: 8.5.11, which is also vulnerable. This time, however, a DNF update got me to a patched release- 8.5.12:
# dnf clean all
# dnf update php\*
<< many lines of update notices >>
Complete!
# php -version
PHP 8.5.12 (cli) (built: Oct 19 2026 17:02:46) (NTS gcc x86_64)
Copyright (c) The PHP Group
# systemctl restart php-fpm
# php-fpm -v
PHP 8.5.12 (fpm-fcgi) (built: Oct 19 2026 17:02:46) (NTS gcc x86_64)
Copyright (c) The PHP Group
Problems for another day
I have another problem here to figure out. I thought my automatic update process was keeping my server current with the latest releases of Fedora, but this is not the case. It is performing kernel (OS core) updates as well as all module updates, but it isn’t doing major upgrades like from Fedora 4.3 to 4.4. I’ve been disappointed by this in the past and thought the latest versions of dnf-automatic covered all upgrade scenarios, but they do not. Ignorant of me to make assumptions, of course, and entirely my own fault. But I do wish things were easier in terms of keeping up with releases.
Worse still as far as I’m concerned is the fact that the Fedora maintainers didn’t release the patch to PHP 8.4 to get it to the 8.4.12 corrective update. I don’t know how long this will be delayed, but a critical vulnerability like PHP2Shell requires nearly immediate response. I understand that Fedora version 44 is the current release and thus the one that gets first attention, but version 43 isn’t that old. Delaying even 12 hours seems like a serious risk to take. I have to assume that the Fedora team have their reasons for the delay and I’m sure they make sense. But I felt compelled to act sooner rather than later- shutting down my sites to mitigate the risk isn’t something I wanted to do.