Fix php2shell on Debian

1. Check what you have installed

Installed PHP packages and their versions:

dpkg -l 'php*' 'libapache2-mod-php*' | grep ^ii

Installed and available version (replace 8.2 with your branch):

apt-cache policy php8.2-common

The fixes come from the security archive. Make sure it is configured:

grep -rhs security.debian.org /etc/apt/sources.list /etc/apt/sources.list.d/

Does PHP come from the Sury repository? If this prints anything, compare with the upstream fixed versions:

grep -rhs sury /etc/apt/sources.list /etc/apt/sources.list.d/

Fixed package versions

2. Install the update

Upgrade only the PHP packages of your branch (replace 8.2):

sudo apt update && sudo apt install --only-upgrade 'php8.2*' 'libapache2-mod-php8.2'

Other Debian releases are not listed here yet. Check the Debian security tracker for CVE-2026-109618 and CVE-2026-109619 before relying on them.

3. Restart PHP

Restart every PHP-FPM service:

sudo systemctl restart "php*-fpm"

If Apache runs PHP as a module (mod_php):

sudo systemctl restart apache2

4. Verify

The installed changelog should mention both CVEs (replace 8.2):

zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php8.2-common/changelog.Debian.gz

Then confirm the version your website really uses with the temporary file from the self-check page.