Update PHP on AlmaLinux, RHEL and Rocky Linux for the PHP2Shell fix

Are AlmaLinux, RHEL and Rocky Linux affected by PHP2Shell?

Yes. Red Hat’s bulletin RHSB-2026-013 lists RHEL 8, 9 and 10 as affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and says RHEL 7 and earlier ship PHP versions that are not affected. AlmaLinux and Rocky Linux rebuild RHEL, so the same streams apply. Red Hat rates the flaws Important and notes that standard RHEL deployments use PHP-FPM rather than mod_php, but every web-facing PHP still needs the update. Upstream PHP fixed these releases:

RHEL-family packages often keep an older PHP number with the fix backported, so compare package versions, not just the PHP number.

How do I check which PHP package my server runs?

Ask the package manager. AlmaLinux’s notice uses rpm -q php-common (or rpm -q php8.4-common on AlmaLinux 10), and dnf module list php shows which module stream is enabled on EL 8 and 9. php -v only reports the command-line binary, and AlmaLinux warns that its backported fixes don’t change that number. The website may also run a different PHP from the CLI (an SCL from Remi, for example): check WordPress Site Health or a temporary php_sapi_name() page, which should report fpm-fcgi for PHP-FPM. The check PHP version guide covers this.

Has Red Hat, AlmaLinux or Rocky shipped a PHP2Shell fix?

Mostly yes, all on 21 October 2026 (Rocky early on 22 October UTC). Install these package versions or newer:

Sources: Red Hat’s CSAF data for CVE-2026-109618 and errata such as RHSA-2026:87079; AlmaLinux’s PHP2Shell notice, which gives the full version strings; and Rocky’s errata such as RLSA-2026:87070. AlmaLinux shipped its own backports before Red Hat, so its numbers are lower than Red Hat’s rebased packages; both carry the fix.

Remi repository: Remi’s repo published php 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 to 22 October 2026, both as module streams in remi-modular and as php82 to php85 collections in remi-safe (EL 9 listing). Builds 7.4.33-31, 8.0.30-21 and 8.1.34-6 carry a changelog entry “Mitigation fix Avoid state corruption via bailout” for both CVEs. Remi’s blog had no PHP2Shell post as of 22 Oct 2026.

How do I update PHP on AlmaLinux, RHEL or Rocky Linux?

1. Refresh metadata and upgrade every PHP package, as AlmaLinux’s notice shows: sudo dnf clean metadata && sudo dnf upgrade 'php*'. The php* pattern also covers Remi collections such as php83-php-fpm.
2. If you enabled AlmaLinux’s testing repo earlier, turn it off: sudo dnf config-manager --disable almalinux-testing.
3. Confirm the result with rpm -q php-common against the table above.

Red Hat’s errata link to its general update guide. On RHEL 9 with php:8.4, no fixed package exists yet: either move to a fixed stream or apply the stopgaps below.

How do I restart PHP-FPM and verify the fix?

Restart PHP so running workers load the new code: sudo systemctl restart php-fpm, plus sudo systemctl restart httpd if you use mod_php (AlmaLinux 8 only; httpd -M 2>/dev/null | grep -E 'mpm_|php' shows whether it’s loaded). Restart any Remi SCL FPM service too. Then check the PHP the website serves, not just the shell, and enter the package version in the PHP version checker.

What if I can’t update yet?

Use PHP’s stopgaps, such as turning off session.upload_progress.enabled in a file under /etc/php.d/ and lowering post_max_size, then restart PHP-FPM. They block specific paths only; see the CVE-2026-109618 workaround page and Red Hat’s bulletin for limits.

What about retired streams like php:7.4, php:8.0 or php:8.1?

AlmaLinux patched its retired streams this time but says future fixes aren’t guaranteed, and upstream PHP offers only source patches for 7.4, 8.0 and 8.1. Plan a move with sudo dnf module reset php, sudo dnf module enable php:8.2 and sudo dnf distro-sync 'php*'. See PHP end of life, the PHP2Shell patch guide and the PHP2Shell checker.