Fix php2shell on Ubuntu

1. Check what you have installed

Installed PHP packages and their versions:

dpkg -l 'php*' 'libapache2-mod-php*' | grep ^ii

Installed and available version of one branch (replace 8.3 with yours):

apt-cache policy php8.3-common

Does PHP come from a third-party PPA such as ondrej/php? If this prints anything, compare with the upstream fixed versions, not the table below.

grep -rhs ondrej /etc/apt/sources.list /etc/apt/sources.list.d/

Fixed package versions

2. Install the update

Upgrade only the PHP packages of your branch (replace 8.3):

sudo apt update && sudo apt install --only-upgrade 'php8.3*' 'libapache2-mod-php8.3'

Ubuntu 16.04, 18.04 and 20.04 get the fix only through Ubuntu Pro (16.04 also needs Legacy Support). Check that ESM is enabled:

pro status

Attach the machine to your Ubuntu Pro subscription if it isn’t yet, then run the upgrade again:

sudo pro attach <your-token>

3. Restart PHP

Running PHP-FPM and Apache workers keep the old code in memory until they restart.

Restart every PHP-FPM service:

sudo systemctl restart "php*-fpm"

If Apache runs PHP as a module (mod_php):

sudo systemctl restart apache2

If needrestart is installed, list services that still use old libraries:

sudo needrestart -r l

4. Verify

The installed changelog should mention both CVEs (replace 8.3):

zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php8.3-common/changelog.Debian.gz

Check a package changelog in the archive before installing it:

apt changelog php8.3-common | grep -E "CVE-2026-10961[89]"

Then confirm the version your website really uses with the temporary file from the self-check page.