What Is PHP2Shell? The AI-Found PHP Flaws Explained

Check the web-facing runtime, not just the CLI. Swap 8.3 for your branch.

# CLI version (may differ from the web runtime)
php -v

# PHP-FPM version on Debian/Ubuntu-style installs
php-fpm8.3 -v

# Distro packages: confirm the fix is in the changelog
apt changelog php8.3-fpm 2>/dev/null | grep -E "CVE-2026-10961[89]"     # Debian/Ubuntu
rpm -q --changelog php-fpm | grep -E "CVE-2026-10961[89]"               # RHEL/Fedora/Alma

# Docker: check the PHP inside each image you deploy
docker run --rm --entrypoint php your-app-image:latest -v

Typical update paths. Restart every worker afterwards, or you are still running the old code.

# Debian/Ubuntu (distro or ondrej/php packages)
sudo apt update && sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm      # PHP-FPM
sudo systemctl restart apache2         # Apache with mod_php

# RHEL/Alma/Rocky
sudo dnf upgrade 'php*' && sudo systemctl restart php-fpm

# Docker: pull the patched base image and rebuild, don't just restart
docker pull php:8.3-fpm
docker build --pull -t your-app-image:latest .
# then redeploy so old containers are replaced

Stopgap settings from the PHP advisory. Put them in php.ini or the FPM pool, not in ini_set() or .user.ini.

; CVE-2026-109619: blocks the upload-progress path
session.upload_progress.enabled = 0

; PHP 8.5 only: blocks the fatal-error backtrace path
fatal_error_backtraces = 0

; CVE-2026-109618: keep request bodies small
post_max_size = 8M          ; 32M if the app takes uploads
upload_max_filesize = 2M    ; must stay below post_max_size

; CVE-2026-109618: PHP suggests removing the PHP memory limit and
; capping memory at the container/cgroup level instead.
; In an FPM pool, use php_admin_value so apps can't override it:
; php_admin_value[memory_limit] = -1

Starting points. Log paths vary by distro and host.

# Memory errors during request setup, before any script ran
grep -E "Allowed memory size .* in Unknown on line 0" /var/log/php*fpm*.log /var/log/apache2/error.log

# Crashing workers (failed exploit attempts often look like this)
grep -E "Segmentation fault|SIGSEGV" /var/log/apache2/error.log /var/log/php*fpm*.log

# Shells started by the web server user: a strong sign of compromise
ps -eo user,pid,ppid,cmd | grep -E '^(www-data|apache|nginx) +[0-9]+ +[0-9]+ +(/bin/|/usr/bin/)?(ba|da)?sh( |$)'