PHP2Shell (CVE-2026-109618 and CVE-2026-109619) Mitigation for OpenMage

The PHP security team has announced an emergency security release addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, potentially allowing unauthenticated remote code execution (RCE).

Both vulnerabilities can potentially allow unauthenticated remote code execution (RCE) through specially crafted HTTP requests.

These vulnerabilities affect the underlying PHP runtime rather than OpenMage itself, potentially exposing OpenMage stores running vulnerable PHP versions.

According to the official PHP security advisory, PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, FrankenPHP, and other PHP web-serving environments are affected.

PHP2Shell: Fixed PHP Versions

On October 21, 2026, the PHP team published the following security releases:

PHP 7.4, 8.0, and 8.1 also received minimal source-level security backports to help Linux distributions and other vendors prepare updated packages.

Upgrading to a fixed PHP release or installing a vendor-confirmed security backport is the only complete solution.

PHP2Shell Updates for AlmaLinux, Rocky Linux, and RHEL (EL8, EL9, EL10)

Updated PHP Packages from Remi’s RPM Repository

The Remi RPM repository published patched PHP packages on October 21, 2026, including builds for Enterprise Linux 8, 9, and 10.

Examples of confirmed package releases:

Legacy PHP support: According to Remi’s confirmation on October 22, PHP2Shell fixes are available for PHP 7.4 through 8.5. Updates for PHP 7.2 and 7.3 are planned, while PHP 7.1 and older are no longer maintained in this repository.

To update a PHP installation using Remi:

sudo dnf upgrade --refresh 'php*'
sudo systemctl restart php-fpm

For Remi Software Collections, such as PHP 8.4 installed as php84-* packages:

sudo dnf upgrade --refresh 'php84-*'
sudo systemctl restart php84-php-fpm

Check the installed PHP package release and security changelog:

rpm -q php-common php-fpm
rpm -q --changelog php-common | \
  grep -E 'CVE-2026-109618|CVE-2026-109619'

For Software Collections, replace the package names with the appropriate prefixes, such as php84-php-common.

Distribution-Native PHP Packages

AlmaLinux has released security backports for every PHP stream shipped with AlmaLinux 8, 9, and 10, including several retired streams.

The patched packages entered production repositories on October 21, 2026, at 21:15 UTC.

A regular update is sufficient:

sudo dnf clean metadata
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

On AlmaLinux 8 systems using Apache mod_php, restart httpd instead.

Note that distribution backports may preserve older PHP version numbers. Compare the complete RPM release against the AlmaLinux patched package list, rather than relying exclusively on php -v.

Red Hat’s PHP2Shell security bulletin confirms that some RHEL security updates are already available, while fixes for additional streams remain in progress.

PHP2Shell Updates for Debian and Ubuntu

Debian and Ubuntu provide security-patched PHP packages through their distribution repositories.

Older Ubuntu releases also have security updates through Ubuntu Pro:

Ubuntu and other distributions frequently backport security fixes while retaining their original PHP version numbers.

Update using:

sudo apt update
sudo apt upgrade

Restart the appropriate PHP-FPM service or Apache after updating.

Sources: Debian Security Tracker, Ubuntu USN-8948-1, and Ubuntu CVE-2026-109618.

PHP2Shell Fixes for Legacy PHP Versions (5.x–8.1)

OpenMage installations using older PHP versions may still receive PHP2Shell security fixes without immediately upgrading to a newer PHP branch.

Although the PHP project no longer releases security updates for PHP 8.1 and older, several Linux distributors, independent maintainers, and commercial extended-support providers have released or are preparing backported fixes.

The following options are particularly relevant to legacy OpenMage and Magento installations.

Confirmed legacy Debian fix: Freexian published ELA-1853-1 on October 21, 2026, fixing both vulnerabilities in Debian 11 PHP 7.4 with package version 7.4.33-1+deb11u14.

CloudLinux and cPanel: CloudLinux confirms patched EasyApache PHP (ea-php52 through ea-php85) packages. Its alt-php builds for legacy PHP versions have also been published. Some CloudLinux-native PHP packages are still undergoing staged rollout, so administrators must distinguish between ea-php, alt-php, and distribution-native packages.

Important: These providers maintain different package sets and release schedules. A patched build from one repository does not imply that the same PHP branch is patched in another. Always verify both CVEs against the installed package’s security advisory or changelog.

For OpenMage stores still depending on PHP 5.x, 7.x, or 8.1, vendor-maintained security backports can provide short-term protection while a PHP modernization or migration is planned. However, fixing PHP2Shell does not restore general security support for an otherwise end-of-life PHP release.

PHP2Shell: Official PHP Docker Images

The official PHP Docker image definitions have been updated to include the patched PHP releases.

For OpenMage deployments using the official php images, the following version-specific tags are listed:

Corresponding Debian- and Alpine-based image variants are also listed, including php:8.4.27-fpm-bookworm and php:8.4.27-fpm-alpine.

Check the official PHP Docker image definitions for the latest published tag information. Image registry availability may lag behind updates to these definitions.

For example:

docker pull php:8.4.27-fpm
docker run --rm php:8.4.27-fpm php -v

For custom OpenMage images, update the PHP base image, rebuild the application image, and recreate the running containers. Updating PHP on the Docker host does not update PHP inside existing containers.

PHP2Shell on Unsupported PHP Versions: An Alternative Mitigation

For legacy PHP installations where official security updates are unavailable, particularly PHP 5.6–8.1, an open-source extension developed by Hosted Power offers a possible alternative to upgrading the entire PHP runtime:

• PHP2Shell on Unsupported PHP Versions: An Alternative Mitigation

Temporary PHP2Shell Mitigation for OpenMage

If a fixed PHP package is not yet available, disabling PHP’s session upload-progress tracking is an immediate precaution recommended by the PHP security team.

In php.ini:

session.upload_progress.enabled = Off

Alternatively, enforce the setting in your PHP-FPM pool:

php_admin_flag[session.upload_progress.enabled] = off

Restart all affected PHP workers after making this change.

This disables PHP’s built-in session-based upload progress tracking, not ordinary file uploads.

Important: This configuration change blocks confirmed exploitation paths for CVE-2026-109619 but does not eliminate every attack vector and does not fully mitigate CVE-2026-109618.

For CVE-2026-109618, the PHP team also provides temporary mitigation guidance involving memory_limit = -1, strict request-size limits, and operating-system or container memory controls. These measures require careful evaluation because changing memory limits can introduce availability risks.

See the official PHP security advisory for the complete guidance.

Recommendations for OpenMage Store Owners

We strongly recommend applying the patched PHP packages immediately, prioritizing public-facing production storefronts.

After updating, verify that the correct PHP runtime is used by the web server, and confirm that checkout, payment integrations, administration, and file uploads operate normally.

We also recommend leaving session.upload_progress.enabled disabled unless your application explicitly requires this functionality.

PHP2Shell affects the underlying PHP runtime, so updating OpenMage itself cannot eliminate these vulnerabilities.

References

• PHP Security Advisory — October 21, 2026
• CVE-2026-109618 — PHP Security Advisory
• CVE-2026-109619 — PHP Security Advisory
• Remi’s RPM Repository
• AlmaLinux — PHP2Shell Security Updates
• Debian Security Tracker
• Ubuntu Security Notice USN-8948-1
• Official PHP Docker Image Definitions