Guide How to Fix PHP2Shell (CVE-2026-109618/109619) on HestiaCP

**JAY** · 10-22-2026, 03:43 PM

How to Fix PHP2Shell (CVE-2026-109618/109619) on HestiaCP

On 21 October 2026 PHP released emergency fixes for two critical bugs, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). They can let an attacker run code on your server without logging in, and attacks are already happening. This guide shows how to patch a server running HestiaCP, step by step.

New to PHP2Shell? Read the overview first: PHP2Shell explained: what it is and how to fix it.

The fixed versions
Your PHP must be at least: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older branches (7.4 to 8.1) need a patched build from your vendor. Update every PHP version installed, not just the one your main site uses.

Step 1: See which PHP versions you have
HestiaCP runs several PHP-FPM versions side by side, installed from the Debian/Ubuntu PHP repository. List them:

Code:

ls /etc/php/
dpkg -l | grep -E 'php8\.[0-9]+-fpm'

Step 2: Update PHP with apt
Take a snapshot of the server first. Then, as root:

Code:

apt update
apt list --upgradable 2>/dev/null | grep -i php
apt -y upgrade

HestiaCP also runs its own PHP for the control panel itself (

Code:

hestia-php

). The normal

Code:

apt upgrade

updates it too when a new build is published.

Step 3: Restart PHP-FPM
Restart every PHP-FPM version with Hestia's own command:

Code:

for v in /etc/php/*/fpm; do s="php$(basename $(dirname $v))-fpm"; v-restart-service "$s" && echo "restarted $s"; done

Step 4: Confirm
Check the installed package versions:

Code:

dpkg -l | grep -E 'php8\.[0-9]+-fpm'

Packages from the Debian/Ubuntu repositories may include the fix while keeping the old version number. Check the changelog:

Code:

zcat /usr/share/doc/php8.3-fpm/changelog.Debian.gz 2>/dev/null | grep -m3 -E 'CVE-2026-10961[89]'

Check the version your websites really use
The command line can show a different PHP from the one serving websites. To be sure, create a file called

Code:

v.php

in a website's folder containing:

Code:

<?php echo PHP_VERSION;

Open

Code:

https://your-domain/v.php

, check the number, then delete the file.

Can't update yet? Temporary protection
These settings reduce the risk until a patched version is installed. They are not a full fix. Add them to the php.ini of each PHP version (

Code:

/etc/php/8.x/fpm/php.ini

, or Server settings > Configure > PHP in HestiaCP), then restart PHP:

Code:

session.upload_progress.enabled = 0
; PHP 8.5 only:
fatal_error_backtraces = 0

Don't set these with

Code:

ini_set()

or a

Code:

.user.ini

file; they must be set server-side. The PHP team also suggests

Code:

memory_limit = -1

against CVE-2026-109618, but that removes PHP's memory cap, so only use it short-term and with care.

After patching: check you weren't hit
Attacks started on 17 October, before the fix existed. Spend ten minutes on these checks:

PHP files created or changed since 17 October that you don't recognise, especially in upload folders:

Code:
find /home/*/web -name "*.php" -newermt 2026-10-17 -type f 2>/dev/null | head -50
Unknown cron jobs:
Code:
crontab -l
for root and each site user.
Unusual CPU use (crypto miners are common):
Code:
ps aux --sort=-%cpu | head

If something looks wrong, change the passwords and API keys your PHP apps use, because these bugs can leak memory contents.

Questions? Ask in HestiaCP Security & Firewall Support with your OS, HestiaCP version and the output of your PHP version check.

Sources (checked 22 October 2026): Tenable PHP2Shell FAQ · Qualys: mitigate and patch PHP2Shell