linux-announce AT lists.psi.ch

Subject: Linux Mailing List

List archive

[[Linux-announce] ] php2shell: Updated PHP Packages for RHEL9, RHEL8 coming...

From: "Konrad Bucheli (PSI)" <konrad.bucheli AT psi.ch>
To: linux-announce AT lists.psi.ch
Subject: [[Linux-announce] ] php2shell: Updated PHP Packages for RHEL9, RHEL8 coming...
Date: Thu, 22 Oct 2026 10:24:16 +0200
Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=psi.ch; dmarc=pass action=none header.from=psi.ch; dkim=pass header.d=psi.ch; arc=none
Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=F2Y6MJDTKURiIdy8yAPTjyQqYJukCKNGtaq8Tq4lJWs=; b=YIiYrU9HTnlfXiaCH7qAxNnaKBVSyjuOg0qZAI0L8saL59xkKxCbGavv6+yymAU7SFZZbEAzE/R4omzxAvYC2f8Ekz+YoYGd/RovMOQqOKK4gGhLySc5jzljgBW+SRaTCh3ruYbZYQ8AyM2qbo3cV6C+U3il+r7SNT0PcmpTasazgVRFf1478POL6gsf3to/Cr6JOJPsy0GBxm4EKdKNlXizlqlUHfFwATUFBAqDHVEZjku0xKQAbaJjUr4pM+YYiDC4HdHk1o5AmEGNbLoK/7aqRFIcezpqOa5loSXBg0CmHF63PnUQRxf6neOHooBq/6aMwVMolhVEVSRDd5RklA==
Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=o5z+T02E+MkL/8tF3Rz1TKnqubXi0KSPbIhN/KvJAPShuKiyAfcAgRYvNbCY0G9nCg3Bveu3FFFKBx/wWoh5Ea9dQb6DbGK1e/7i7Bc5d8BpB4rFXUuhvlJUCaDqkveBYBV3Bbp1mYimdQM0XD3X7HkQ+CMSUEcpO43iVtKDJcRfcHDkRWmHeCM21VY7ecM+sVwv26ba+h6bR0b6AIZdvXHdI1ozWRnETzEXvRDrHo3zZZko+naXhwpGPQIO6/ygTLfdUfHh8L9k4JhgCU3FuQL/AxiuJ2B4JiBuSDuOmGHKEOL3v8keqdPp+70UfLwq6FJv7s1a7geuz62IYb505g==
Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=psi.ch;

Dear Linux Admins

I guess you already got informed about the php2shell vulnerability [1].

For RHEL9 the updated packages are available in an snapshot on repos.psi.ch.
For RHEL8 the snapshot is in the doing, I will update when ready (in a small number of hours)
Note that not all available PHP module stream versions are patched, some are EOL.

Here the actual list from RedHat [2]:

RHEL8 php:8.2 Fixed
RHEL8 php:7.4 Fixed
RHEL9 php:8.2 Fixed
RHEL9 php:8.3 Fixed
RHEL9 php Fixed
RHEL9 php:8.4/php Affected
RHEL10 php Fixed
RHEL10 php8.4 Fixed

Please note that despite some mitigation recommendations, the PHP project states:

> Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.
[3]

If you have questions or need support, please contact linux-eng AT psi.ch or the Support channel of the Linux Team in Teams.

Happy Patching
Konrad

[1] https://www.heise.de/en/news/php2shell-Critical-flaws-allow-code-injection-in-PHP-11494897.html
[2] https://access.redhat.com/security/cve/cve-2026-109618
[3] https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

--
Paul Scherrer Institut
Konrad Bucheli
Linux Systems Engineer
Core Linux Research Services
Science IT Infrastructure and Services department (AWI)
OBBA/230
Forschungstrasse 111
5232 Villigen PSI
Switzerland

Phone: +41 56 310 27 24
konrad.bucheli AT psi.ch
www.psi.ch

[[Linux-announce] ] php2shell: Updated PHP Packages for RHEL9, RHEL8 coming..., Konrad Bucheli (PSI), 10/22/2026