Scalable Stories

PHP2Shell on AlmaLinux, Rocky Linux and RHEL 8/9/10: Check and Patch

Play Episode Pause Episode

1x

00:00 / 00:10:03

Apple Podcasts

RSS Feed

Share

Link

Embed

<blockquote class="wp-embedded-content" data-secret="KRo1aFWRb0"><a href="https://www.getpagespeed.com/podcast/php2shell-on-almalinux-audio">PHP2Shell on AlmaLinux, Rocky Linux and RHEL 8/9/10: Check and Patch</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://www.getpagespeed.com/podcast/php2shell-on-almalinux-audio/embed#?secret=KRo1aFWRb0" width="500" height="350" title="&#8220;PHP2Shell on AlmaLinux, Rocky Linux and RHEL 8/9/10: Check and Patch&#8221; &#8212; GetPageSpeed" data-secret="KRo1aFWRb0" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script> /*! This file is auto-generated */ !function(d,l){"use strict";l.querySelector&&d.addEventListener&&"undefined"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),o=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),c=new RegExp("^https?:$","i"),i=0;i<o.length;i++)o[i].style.display="none";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute("style"),"height"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):"link"===t.message&&(r=new URL(s.getAttribute("src")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",function(){for(var e,t,s=l.querySelectorAll("iframe.wp-embedded-content"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute("data-secret"))||(t=Math.random().toString(36).substring(2,12),e.src+="#?secret="+t,e.setAttribute("data-secret",t)),e.contentWindow.postMessage({message:"ready",secret:t},"*")},!1)))}(window,document); //# sourceURL=https://www.getpagespeed.com/wp-includes/js/wp-embed.min.js </script>

Technical Briefing: PHP2Shell on AlmaLinux, Rocky Linux and RHEL 8/9/10 (Runbook Edition)

Today’s source is the same GetPageSpeed article on patching PHP2Shell (CVE-2026-109618 and CVE-2026-109619) that the 2026-11-09 and 2026-11-10 briefings covered. Those editions explained the vulnerabilities, the coverage differences and the verification steps. This edition reorganises the same material by situation, so an administrator can find the steps for their own server. Commands, versions and caveats are as stated in the article.

The Problem (Short Recap)

• CVE-2026-109618: RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w), CVSS v4.0 9.2.
• CVE-2026-109619: RCE via stale global state (GHSA-6wmf-4rv5-p3rp), CVSS v4.0 9.2.
• Impact: a single unauthenticated request can take over a PHP server.
• Affected: PHP 5.4 and later, on all web SAPIs (PHP-FPM, mod_php, php-cgi).
• Fixed upstream: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The right fix depends on three things: your distribution, your enabled PHP stream or collection, and whether that stream is still maintained.

Step 0: Identify Your Situation

1. Find the enabled stream with dnf module list php. The [e] marker shows which one is enabled.
   • No [e] means you have the default AppStream PHP. That is 8.0 on AlmaLinux 9 and 7.2 on AlmaLinux 8.
   • AlmaLinux 10 has no PHP modules. Base PHP is 8.3, and 8.4 comes as separate php8.4 packages.
2. For Remi module streams, run dnf module list --enabled php. It shows names like remi-7.4 or remi-8.1.
3. Software collections use names such as php74-php*, with matching services such as php74-php-fpm.

Then go to the matching path below.

Path A: AlmaLinux (any supported or retired stream)

AlmaLinux covers every stream in the table further down. This includes four streams Red Hat retired, which AlmaLinux patched on October 23:

• PHP 7.2, 7.3 and 8.0 on AlmaLinux 8
• PHP 8.1 on AlmaLinux 9

Run:

dnf upgrade 'php*'
systemctl restart php-fpm

• mod_php users: restart httpd instead.
• The stream does not change. PHP 7.4 stays 7.4 and PHP 8.2 stays 8.2. You get that stream’s fixed build.
• AlmaLinux 10 with PHP 8.4: the optional packages are named php8.4-*, and the 'php*' pattern covers them.
• Advisories: ALSA-2026:87070 to 87151, plus A011 to A014.

Path B: Rocky Linux or RHEL on a maintained stream

The maintained streams are php:7.4 and php:8.2 on EL8, the AppStream 8.0, php:8.2 and php:8.3 on EL9, and everything on EL10.

• Rocky Linux rebuilt the Red Hat advisories under the same numbers: RLSA-2026:87070, 87072, 87073, 87079, 87080 and 87151.
• RHEL subscribers get the matching RHSA advisories.
• The same update commands work unchanged: dnf upgrade 'php*', then restart php-fpm (or httpd for mod_php).

Path C: Rocky Linux or RHEL on a retired stream

The retired streams are 7.2, 7.3 and 8.0 on EL8, and 8.1 on EL9. The distribution ships no fixed package for these. Switch to a maintained stream:

dnf module switch-to php:8.2
systemctl restart php-fpm

• Test the application first. A jump from 7.x to 8.2 changes language behaviour, not just the security fix.

Path D: Remi PHP, 7.2 and later (EL8) or 7.4 and later (EL9)

Module streams: remi-release enables remi-modular and remi-safe by default. A plain update pulls the fix:

dnf upgrade 'php*'
systemctl restart php-fpm

• Remi’s EOL branches list the CVEs in their changelog, so the grep check works for them.
• Builds verified on AlmaLinux 9: php-cli-7.4.33-31.module_php.7.4.el9.remi and php-cli-8.1.34-6.module_php.8.1.el9.remi.

Software collections:

dnf upgrade 'php74-php*'
systemctl restart php74-php-fpm

• Replace php74 with your collection.
• Fixed EL9 examples: php74-php-cli-7.4.33-31.el9.remi, php81-php-cli-8.1.34-6.el9.remi and php83-php-cli-8.3.36-1.el9.remi.

Path E: Remi 5.6, 7.0 or 7.1 (no Remi fix)

These are the versions Remi carried as of November 5, 2026:

• PHP 5.6 on EL9 from a third-party php56 collection is also unfixed. The EL9 drop-in php56 collection replaces it in the same way.
• About the drop-ins:
  • They are third-party patched builds with the same package names, so a plain update replaces Remi’s packages in place.
  • They are x86_64 only.
  • They work on AlmaLinux, Rocky Linux and RHEL 8 or 9.

To install and update:

dnf -y install https://extras.getpagespeed.com/release-latest.rpm
dnf update 'php56-php*'
systemctl restart php56-php-fpm

• On EL8, swap php56 for php70 or php71 as needed.
• Remi’s extensions, such as the pecl packages, stay installed and keep loading.
• To confirm, run rpm -q --changelog php56-php-cli | grep CVE-2026-109618. php -v also reports the new builder.

Path F: CentOS 7 (and CentOS 6)

• Neither Red Hat nor Remi ships a PHP2Shell fix for CentOS 7. The article advises against waiting for an AlmaLinux migration.
• Third-party drop-in patched builds exist for every PHP from the stock 5.4 to 8.4, in both Remi package shapes. You can patch in place now and migrate on your own schedule.
• CentOS 6 users should look for equivalent CentOS 6 guidance.

Verification (all paths)

1. Check for pending fixes: dnf updateinfo list --cve CVE-2026-109618
   • Any output line means a fix is pending. Example: ALSA-2026:87151 Important/Sec. php-cli-8.0.30-8.el9_8.1.
   • No output means nothing is pending for the installed packages.
2. Check the installed release: rpm -q php-cli php-fpm, then compare against the table below.
3. Changelog check, with a caveat: rpm -q --changelog php-cli | grep -E 'CVE-2026-10961[89]'
   • Works for backported builds: the AlmaLinux 9 AppStream 8.0 build and the 7.2, 7.3, 7.4, 8.0 and 8.1 streams.
   • Misleading for rebased builds: the 8.2 and 8.3 streams, and PHP 8.4 on AlmaLinux 10. Their changelog only says “rebase to 8.3.36” or the equivalent version.
   • An empty grep on these streams does not mean vulnerable. Check the version instead: 8.2.35, 8.3.36 or 8.4.27 or later is fixed.
4. Confirm the restart happened. PHP-FPM workers that are already running keep the old code in memory until they are restarted.

Fixed php-cli releases

The .alma.1 releases are AlmaLinux’s own patches for streams Red Hat no longer maintains.

If You Cannot Patch Today

Partial PHP settings: memory_limit=-1, a low post_max_size, and session.upload_progress.enabled=0.

• None of these closes both CVEs.
• session.upload_progress.enabled=0 blocks one confirmed path for CVE-2026-109619. It does nothing for CVE-2026-109618.

NGINX rule: add this to every server block that passes requests to PHP. It rejects multipart requests, which is the format that triggers the bug.

if ($http_content_type ~* "multipart/form-data") { return 403; }

• It breaks every file upload.
• Some shops submit cart or checkout forms as multipart, so test an order after adding it.
• Remove the rule once PHP is updated.

Practical Payoff

• Most servers need two commands: dnf upgrade 'php*' and a PHP-FPM restart (or httpd for mod_php). The stream stays the same, so the application is not affected.
• AlmaLinux users on retired streams get a fix without a version jump. Rocky Linux and RHEL users on those streams must switch streams and test.
• Remi 5.6 to 7.1 and CentOS 7 servers can be patched in place with same-name drop-in builds. Migration can then happen on your own schedule.
• Verification is reliable if you use dnf updateinfo or compare versions. Do not rely only on the changelog grep for rebased 8.2, 8.3 and 8.4 builds.

Read the full article: PHP2Shell on AlmaLinux, Rocky Linux and RHEL 8/9/10: Check and Patch