Fix php2shell on RHEL, AlmaLinux and Rocky Linux

1. Check what you have installed

Installed PHP packages:

rpm -qa 'php*' | sort

Enabled PHP module stream (RHEL 8 and 9):

dnf module list --enabled php

Does PHP come from Remi’s repository?

dnf repolist | grep -i remi

Is an erratum for these CVEs available for your system yet?

dnf updateinfo list --cve CVE-2026-109618 --cve CVE-2026-109619

2. Install the update

Upgrade the PHP packages:

sudo dnf upgrade 'php*'

Remi software collections (php83-php-* and similar) are separate packages:

sudo dnf upgrade 'php*-php-*'

On an end-of-life stream (8.1 or older) with Remi, move to a supported branch, for example 8.3:

sudo dnf module reset php && sudo dnf module enable php:remi-8.3 && sudo dnf upgrade 'php*'

3. Restart PHP

Restart PHP-FPM and Apache:

sudo systemctl restart php-fpm httpd

Remi collections run their own FPM service (replace 83):

sudo systemctl restart php83-php-fpm

List services that still use old libraries (dnf-plugins-core):

sudo dnf needs-restarting -s

4. Verify

The RPM changelog should mention both CVEs:

rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"

For a Remi collection (replace 83):

rpm -q --changelog php83-php-common | grep -E "CVE-2026-10961[89]"

Then confirm the version your website really uses with the temporary file from the self-check page.