yum upgrades for production use, this is the repository for you.
Active subscription is required.
Technical Briefing: Free Patched PHP 7.4 for Ubuntu 20.04 Against PHP2Shell
Today’s source is a GetPageSpeed article about a gap left by PHP2Shell, a pair of critical remote code execution flaws in PHP. On Ubuntu 20.04 (focal), the official fix is available only to Ubuntu Pro subscribers, and the sury PPA no longer builds for focal. GetPageSpeed’s existing extras repository now carries a free rebuilt php7.4 package that fixes both CVEs and upgrades existing installs in place. The article covers the vulnerabilities, why focal servers were stuck, installation, validation, version checks, and caveats.
The Problem: PHP2Shell
PHP2Shell is a pair of critical, unauthenticated RCE flaws. The PHP security team disclosed them on October 21, 2026, and Tenable reports they are now broadly exploited in the wild.
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), CVSS v4.0 9.2: RCE via out-of-memory corruption.
- An OOM during request startup, such as while parsing a multipart upload, leaves request data half-initialised.
- Cleanup then treats that data as valid, which gives the attacker control of that memory.
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), CVSS v4.0 9.2: RCE via stale global state.
- Freed request-owned state survives into the next request on the same worker.
- The confirmed paths are session upload progress and INI diagnostics emitted before initialisation.
Affected: PHP 5.4 and later, on all web SAPIs: PHP-FPM, mod_php, php-cgi, LiteSpeed and FrankenPHP.
Fixed upstream: only in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For 7.4, php.net published only a minimal, source-only backport.
Why Focal Servers Were Stuck
- Ubuntu’s fix requires a paid subscription. It ships as
7.4.3-4ubuntu2.29+esm5and is available only to Ubuntu Pro subscribers. Without Pro, apt leaves you on the last standard-support update. - The sury PPA no longer covers focal.
ppa:ondrej/phpdeleted its focal packages in May 2025.- The last focal build was
1:7.4.33-20. - Sury’s fix,
1:7.4.33-31, was built only for Debian 11+ and Ubuntu 22.04+. - Focal servers that rely on the PPA have been frozen for seventeen months.
- The last focal build was
Until now, the options were to compile from source with a hand-applied patch, pay for Pro, or stay exposed.
The Fix: php7.4 1:7.4.33-31+gps1 from the GetPageSpeed Extras Repository
The package is free and needs no subscription.
Install and upgrade
wget https://extras.getpagespeed.com/release-latest.deb
sudo apt install ./release-latest.deb
sudo apt update
sudo apt upgrade 'php7.4-*'
sudo systemctl restart php7.4-fpm
If you use Apache mod_php, restart apache2 instead of PHP-FPM.
In-place upgrade
- The packages keep the same
php7.4-*names, the same/etc/php/7.4layout and the same epoch as sury. - Both stock Ubuntu 7.4.3 installs and frozen sury 7.4.33-20 installs upgrade cleanly.
php.ini, FPM pools and enabled modules carry over untouched.
More than the PHP2Shell fix
The package rebuilds sury’s 1:7.4.33-31 source against stock focal libraries. It therefore includes every security backport from -20 to -31:
- mysqlnd packet overreads
- OpenSSL hostname verification bypasses
- phar TAR entry injection
- SOAP/XML hardening
- FastCGI
allowed_clientsIPv6 bypass - HTTP redirect credential leaks
- both PHP2Shell CVEs, using upstream’s official 7.4 backport as-is
Validation
Testing was done in a pristine ubuntu:20.04 container:
- Both exploit probes were reproduced on stock focal PHP 7.4:
- memory-limit unwinding through the vulnerable path
- the rfc1867 session upload-progress hook firing
- After the upgrade, both probes were shown to be fixed.
php -mlisted the identical module set, and hand-edited config survived.- PHP-FPM kept serving after an OOM request.
- The same harness was re-run against the published repository using the exact commands above.
Check Your Version
Run:
dpkg -l 'php7.4-cli' | awk '/^ii/{print $3}'
Vulnerable versions:
– 7.4.3-4ubuntu2.x without +esm (stock focal, no Pro)
– 1:7.4.33-20+ubuntu20.04.1+deb.sury.org+1 or older (frozen sury)
Patched versions:
– 7.4.3-4ubuntu2.29+esm5 (via Ubuntu Pro)
– 1:7.4.33-31+gps1+ubuntu2004+stable (via GetPageSpeed)
Other distros: paste your package list into the PHP2Shell checker. It understands distro backports and gives the fix for every platform.
Caveats and Rollback
- Rollback: These packages have the same epoch and a higher version, so apt prefers them. To roll back, run
apt install php7.4-cli=<old version>. - Intentional behaviour change: A request that hits
memory_limitnow ends its worker immediately. Shutdown functions do not run and buffered output is not sent.- This mirrors the PHP security team’s own EOL backports, because the unsafe unwinding is exactly what PHP2Shell abuses.
- Review any code that catches memory exhaustion in a shutdown handler.
session.upload_progress.enabled=0is not enough. It blocks one CVE-2026-109619 path and does nothing for CVE-2026-109618. Only an update is a complete fix.- Still end-of-life: PHP 7.4 is EOL and Ubuntu 20.04 is out of standard support. The package keeps the PHP layer patched while you plan a migration, but it does not restore support.
- Other suites: PHP 7.2 on Ubuntu 18.04 and Debian 10 has the same gap, with ESM/ELTS-only fixes and no sury builds. Rebuilds are being extended to them. Focal came first because it has the largest exposed population.
- The same repository also carries current NGINX builds and modules for focal.
Practical Payoff
Focal servers running PHP 7.4 can close both actively exploited PHP2Shell CVEs, plus the sury security backports from -20 to -31, with a standard apt upgrade. This requires no Ubuntu Pro subscription, no source build, and no config migration. The trade-offs are the new memory_limit behaviour and the fact that the platform remains end-of-life.
Read the full article: PHP2Shell on Ubuntu 20.04: Patched PHP 7.4 Without Ubuntu Pro