PHP2Shell and Nextcloud: is your Nextcloud server affected?

Is my Nextcloud server affected by PHP2Shell?

Your Nextcloud server is affected if the PHP it runs on is below the fixed release for its branch, or is PHP 8.1 or older without a vendor patch. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself, so the Nextcloud version and installed apps don’t change whether you are in scope. A Nextcloud server often holds a whole family’s or company’s files, so treat this as urgent.

Does updating Nextcloud fix PHP2Shell?

No. A Nextcloud release or app update changes Nextcloud code, not PHP. The fix depends on how you installed Nextcloud.

We found no Nextcloud security advisory about PHP2Shell in Nextcloud’s GitHub advisory list as of 22 Oct 2026. The project’s statement came through Nextcloud All-in-One (AIO): AIO v14.4.1, released on 21 October 2026, opens with “PHP CVEs. Upgrade to this version now!” and says it “ships the updated php dependencies”. The maintainers track the issue in AIO issue #8876.

How do I find the PHP version Nextcloud runs on?

• In the web interface: as an administrator, open Administration settings → System. The bundled Monitoring app shows the PHP version there, if it is enabled.
• Official Docker image: run php -v inside the Nextcloud container, for example with docker compose exec and your service name.
• AIO: run sudo docker exec nextcloud-aio-nextcloud php -v on the host.
• Your own server: check the PHP-FPM or Apache module version, not just the command-line php -v.

Enter the version in the PHP2Shell checker. More methods: check PHP version.

Which PHP version should Nextcloud move to?

Move to the fixed release on a branch your Nextcloud version supports. Nextcloud’s system requirements list:

On your own server, the quickest move is the fixed release on your current branch. Nextcloud 32 on PHP 8.1 has no new PHP release to install; move to 8.2 or newer. See PHP end of life.

Who updates PHP for my Nextcloud?

AIO: in the AIO interface, stop the containers, update the mastercontainer when it offers the update, then click Start and update containers. AIO recommends a backup first. In issue #8876 a user reports v14.4.1 running PHP 8.4.27; confirm your own version afterwards.

Official Docker image: the nextcloud image is built on Docker’s official PHP image, which received the fixed releases. Docker Hub shows the nextcloud tags re-pushed on 21 October 2026, but we haven’t verified the PHP inside each tag. Run docker compose pull and docker compose up -d, then check php -v in the new container. If you build your own image on top of nextcloud, rebuild it with a fresh pull. See Docker PHP image.

How do I tell if my Nextcloud was already compromised?

Updating PHP stops new attacks but says nothing about the past. Check:

• Code integrity: run occ integrity:check-core, or look at the integrity check result in Administration settings → Overview.
• Users: members of the admin group you don’t recognise.
• Apps: anything in the Apps list, or in custom_apps, you didn’t install.
• Volumes: pulling a new image replaces the container, not your volumes. Config, apps and data persist, and so would anything planted there.

If you find something, follow the compromise checklist, then change passwords and app passwords.

Does a WAF, VPN or PHP setting protect Nextcloud until I patch?

None of them is a fix. Cloudflare says its WAF blocks known patterns, but saw attackers altering requests to get past it. A VPN narrows who can reach Nextcloud. Before patching, the AIO maintainers suggested stopping the containers. PHP’s official stopgaps block specific paths only; see the CVE-2026-109618 workaround and the PHP2Shell patch guide.