Php2shell (Cve-2026-109618 / Cve-2026-109619) Server Mitigation

This guide secures your Ubuntu/Debian server against the critical "PHP2Shell" memory-corruption vulnerability. It also configures the server to automatically install future security and PHP patches in the background, while safely holding standard system updates for scheduled manual maintenance windows to prevent unexpected downtime.

Phase 1: Configure Smart Unattended Upgrades

First, we configure the server to handle security updates automatically while ignoring feature updates.

1. Install the automation packages

This command installs the core utilities required to run automatic background updates and read package changelogs.

sudo apt install unattended-upgrades apt-listchanges

2. Configure Allowed Origins

This command opens the main configuration file in the nano text editor.

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Modify the file so it explicitly trusts the Ondřej Surý PHP repository and blocks standard feature updates. Your configuration block should look exactly like this (notice the "//" commenting out the updates line):

Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-security";
        // Extended Security Maintenance
        "${distro_id}ESMApps:${distro_codename}-apps-security";
        "${distro_id}ESM:${distro_codename}-infra-security";
        
        // Add the PHP PPA to allowed automatic updates
        "LP-PPA-ondrej-php:${distro_codename}";
        
        // Comment this out to block standard feature updates from installing automatically
//      "${distro_id}:${distro_codename}-updates";
//      "${distro_id}:${distro_codename}-proposed";
//      "${distro_id}:${distro_codename}-backports";
};

3. Enable the automation timer

This command opens the timer configuration file.

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

Ensure the file contains only these two lines to turn on the daily update check and installation script:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Phase 2: Execute the Manual Upgrade & Cleanup

Now we manually push through the pending updates to secure the server immediately.

1. Run the system upgrade

This command fetches the latest package lists and installs all pending updates (including the PHP vulnerability patches). If prompted about modifying existing configuration files, always press 'N' or 'O' to keep your current custom configurations.

sudo apt update && sudo apt upgrade

2. Clean up orphaned dependencies

This command safely deletes old, unused packages and outdated Linux kernels left behind by the major system upgrade to free up disk space.

sudo apt autoremove --purge

Phase 3: Flush Memory and Apply Patches

Updating the files on the hard drive is not enough. You must restart the active processes to load the secure code into memory.

1. Reboot to apply kernel updates

This command restarts the entire server to load the new core Linux kernel into active memory.

sudo reboot

2. Restart web and PHP workers

Run these commands after logging back in. This flushes the old, vulnerable PHP processes from your web server workers.

If you are using Apache:

sudo systemctl restart apache2 php8.1-fpm

If you are using Nginx:

sudo systemctl restart nginx php8.1-fpm

(Note: Replace php8.1-fpm with whatever specific PHP version pools you actively run, e.g., php7.4-fpm or php8.2-fpm).

Phase 4: Verification

Confirm the newly patched PHP binary is actively running.

php -v

Look for a recent "(built: [Date])" timestamp in the output corresponding to the recent patch release (e.g., October 2026), rather than an older build date.