PHP CVE 2026 109618 Patch For Forge Ubuntu (PHP2Shell)

Disclaimer: use at your own risk. This article describes what worked on our own Ubuntu servers managed with Laravel Forge. Your setup may differ. Every command below changes packages on a production server, so take a snapshot or backup first, try it on a staging server if you can, and read each command before you run it. We give no warranty and accept no liability for any damage, downtime or data loss.

Last updated: 22 October 2026.

What happened

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical vulnerabilities that can allow unauthenticated remote code execution. The PHP security team rated both 9.2 on the CVSS v4.0 scale. Details had leaked a day before the release, so patch as soon as you can.

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), RCE via OOM corruption: out-of-memory handling can interrupt PHP while request data is only partly initialized.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), RCE via stale global state: state from one request can survive after its memory is freed, and a later request on the same worker may use it.

Every PHP installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php the highest risk. PHP 8.1 and older get no official fix from the PHP project.

First: the “Ign” lines are not your problem

On Forge servers, apt update may print lines like these:

Ign:18 https://ppa.launchpadcontent.net/laravelphp/forge/ubuntu noble InRelease
Hit:19 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease

Ign means apt could not fetch the index of the Laravel Forge PPA and skipped it. That is a warning, not an error, and it usually goes away once Launchpad is less busy. More importantly, PHP itself does not come from that PPA. The Forge PPA only carries a few extensions (php-imagick, php-memcached, php-msgpack). PHP comes from Ondřej Surý’s repository (ondrej/php), so that is the one to look at.

Step 1: Find out what you run

lsb_release -cs                 # jammy = Ubuntu 22.04, noble = Ubuntu 24.04
ls /etc/php                     # which PHP versions are installed
sudo apt update
apt-cache policy php8.3-fpm php8.4-fpm | grep -E '^php|Installed|Candidate'

Add every PHP version you have to the last command. You are patched when the installed version is 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer). If Installed and Candidate both show an older version, your repository does not offer the fix yet. In that case, read Step 2, then Step 3B.

Step 2: Add the stopgaps while you wait

These settings reduce exposure to specific attack paths. They do not make a server safe; only the update does. Put them in a drop-in file instead of editing php.ini, because Forge may rewrite php.ini:

for v in 8.3 8.4; do
  printf 'session.upload_progress.enabled = 0\nsession.use_strict_mode = 1\n' \
    | sudo tee /etc/php/$v/fpm/conf.d/99-php2shell-mitigation.ini
  sudo systemctl restart php$v-fpm
done

# Check (should show 0 and 1):
php-fpm8.3 -i | grep -E 'upload_progress.enabled|use_strict_mode'

Change 8.3 8.4 to the versions on your server. You can keep this file after patching: PHP recommends strict session mode for every site, and few apps use the upload-progress feature.

Step 3A: Upgrade from the ondrej PPA (if it has the fix)

On the day of the release, Ondřej’s Launchpad PPA was behind. By now it has published the fixed builds for Ubuntu 22.04 and 24.04. If apt-cache policy shows the fixed version as the candidate, upgrade only the PHP packages:

sudo apt-get install -s --only-upgrade 'php*' | grep -E '^Inst'   # dry run first
sudo apt-get install --only-upgrade 'php*'

Keep the quotes around 'php*', so your shell does not expand the asterisk. Then go to Step 4.

Step 3B: Switch to packages.sury.org (if the PPA is still behind)

Ondřej also publishes his packages at packages.sury.org, and that repository had the fixed builds first. The Launchpad PPA is being merged into it anyway, so switching now is not a detour. Do not enable both at the same time: two sources for the same packages give confusing upgrade candidates.

1. Move the ondrej PPA out of the way (moving instead of deleting lets you switch back). Leave the laravelphp/forge PPA alone.

grep -rl 'ondrej/php' /etc/apt/sources.list.d/
# Move whatever file(s) it lists, for example:
sudo mv /etc/apt/sources.list.d/ondrej-ubuntu-php-noble.sources /root/

2. Add packages.sury.org. The $(lsb_release -cs) part fills in your own Ubuntu release. Do not type noble or jammy by hand; see the error below.

sudo curl -fsSLo /usr/share/keyrings/deb.sury.org-php.gpg https://packages.sury.org/php/apt.gpg
printf 'Types: deb\nURIs: https://packages.sury.org/php/\nSuites: %s\nComponents: main\nSigned-By: /usr/share/keyrings/deb.sury.org-php.gpg\n' "$(lsb_release -cs)" \
  | sudo tee /etc/apt/sources.list.d/php.sources
sudo apt update
apt-cache policy php8.3-fpm php8.4-fpm | grep -E '^php|Installed|Candidate'

The candidate should now be a fixed version such as 8.3.36-1+0~20261021… coming from packages.sury.org/php. If it is, run the dry run and upgrade from Step 3A.

The “unmet dependencies” error (libc6, libssl3t64, libicu74)

If the upgrade fails with something like this:

php8.3-cli : Depends: libc6 (>= 2.38) but 2.35-0ubuntu3.15 is to be installed
             Depends: libssl3t64 (>= 3.0.0) but it is not installable
E: Unable to correct problems, you have held broken packages.

then the repository points at the wrong Ubuntu release. libc6 2.35 means the server runs Ubuntu 22.04 (jammy), but apt is offering builds for 24.04 (noble). Nothing was installed; apt stopped before changing anything. Fix the suite and try again:

sudo sed -i "s/^Suites: .*/Suites: $(lsb_release -cs)/" /etc/apt/sources.list.d/php.sources
sudo apt update

Step 4: Restart everything and verify

A running process keeps the old PHP in memory until it restarts. Upgrading the package alone is not enough.

sudo systemctl restart php8.3-fpm php8.4-fpm
php artisan queue:restart          # in each Laravel site; also restart Horizon / Octane / Supervisor daemons

# Apache with mod_php needs a full restart (a reload is not enough):
# sudo systemctl restart apache2

# Check the installed versions:
dpkg -l 'php8.[34]-fpm' | awk '/^ii/{print $2, $3}'

# List processes still running the old PHP (empty output = all good):
sudo grep -lE ' /(usr|lib|opt).*\(deleted\)$' /proc/[0-9]*/maps

Is packages.sury.org a safe repository?

It is as trustworthy as the Launchpad PPA, because it is the same maintainer and the same packages. Ondřej Surý is a Debian developer and maintains PHP in Debian. If your server already used ppa:ondrej/php (every Forge server does), you already trust him. Packages are signed, and the Signed-By line limits his key to this one repository.

The caveats: it is a third-party, volunteer-run repository, not supported by Canonical. And the key is downloaded from the same domain as the packages. If you want to check it, compare the output of gpg --show-keys /usr/share/keyrings/deb.sury.org-php.gpg with the fingerprint Ondřej publishes. For an unpatched server with a leaked RCE, staying put is the much bigger risk.

Notes for Laravel Forge users

• If you install a new PHP version through the Forge panel later, Forge may add ppa:ondrej/php again. Check with grep -rl ondrej /etc/apt/sources.list.d/ and move it out if you switched to packages.sury.org.
• Forge servers often run more than one PHP version. Patch and restart all of them, not only the CLI default.
• Use drop-in files in conf.d for your own settings, so they survive Forge rewriting php.ini.

Sources

• Mattias Geniar: PHP CVE-2026-109618 and CVE-2026-109619, how to apply the patches
• Mattias Geniar: early mitigation steps
• Ondřej Surý’s PPA for PHP on Launchpad
• packages.sury.org/php
• Ubuntu CVE tracker: CVE-2026-109618

Once more: use at your own risk. This is a write-up of what worked for us, not professional advice. Check the official PHP advisory and your own package sources, back up first, and test before you change production servers.

Last Updated on 22 October 2026