PHP2Shell: two critical flaws to fix on your VPS
Hello everyone,
Does your VPS host a website or web application that uses PHP? Update PHP now. Both Linux and Windows can be affected.
Two critical PHP vulnerabilities, known together as PHP2Shell, were disclosed on October 21, 2026. Tracked as CVE-2026-109618 and CVE-2026-109619, they can allow an attacker to run code on a vulnerable server without having a user account on the website.
These vulnerabilities are in PHP itself. They are not caused by BoxToPlay or by a flaw specific to our servers.
Who needs to update PHP?
If you manage PHP on your VPS, check the version your websites use, even if they are working normally. PHP may have been installed directly, through an administration panel or inside a container.
For the free web hosting we manage at BoxToPlay, the PHP packages have already been updated. You do not need to carry out this PHP update yourself.
How do you update PHP?
Before making changes, make sure you have a recent backup of your data.
On Debian or Ubuntu, if PHP is installed from the system’s package repositories, run these commands over SSH as root:
apt update && apt upgrade
This command updates all packages for which an update is available. Review the proposed changes before confirming, then check that your repository provides a PHP security fix.
On Windows, if you installed PHP manually, use the official PHP downloads for Windows that match your setup.
If an administration panel or another application manages your PHP installation, follow its update procedure, whether you use Linux or Windows.
If PHP runs inside a Docker container, use an image that includes the fix, then recreate the container while preserving its data. Updating the VPS operating system does not update PHP inside the container.
Restart the services that run PHP, such as PHP-FPM or your web server, so they load the fixed version. Allow for a brief interruption, then check that your websites and applications respond correctly.
How do you check that PHP is fixed?
The PHP project released the fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Use one of these versions or a newer version in the same branch.
Linux distributions may also apply the fixes to an older version without changing its main version number. On Ubuntu 24.04, for example, package 8.3.6-0ubuntu0.24.04.13 includes both fixes. Compare the full package revision with your distribution’s security advisory.
Keep in mind that php -v shows the command-line version, which may differ from the one your websites use. Also check which version is active in your panel or web server configuration.
If you still use PHP 8.1 or an earlier version, check whether your package supplier offers a fix. If no fix is available, move to a maintained version that is compatible with your applications.
You can find the details in the official PHP advisory, Ubuntu’s explanation of PHP2Shell and the Ubuntu security advisory.
Unsure which version you use, or having trouble after updating? Contact BoxToPlay support from your client area.
The BoxToPlay team