Update PHP (the real fix)
This is the only thing that actually fixes CVE-2026-109618 and CVE-2026-109619.
Fixed versions
| You have | Update to |
|---|---|
| PHP 8.5 | 8.5.12 or newer |
| PHP 8.4 | 8.4.27 or newer |
| PHP 8.3 | 8.3.36 or newer |
| PHP 8.2 | 8.2.35 or newer (8.2 stops getting fixes on 31 Dec 2026) |
| PHP 8.1 or older | No official fix. Upgrade to 8.2+, or get a patched package from your OS vendor. |
How
- Ubuntu / Debian:
sudo apt update && sudo apt upgrade. Your version number may not change: the vendor patches it in place. Check Ubuntu or Debian. - Red Hat / Rocky / Alma / Fedora:
sudo dnf upgrade. Check Red Hat. - macOS (Homebrew):
brew upgrade php - Windows: download the new version from php.net, or update XAMPP/Laragon.
- Docker: bump the tag in your Dockerfile (e.g.
php:8.3.36-fpm) and rebuild. - Shared hosting: pick the newest PHP in your panel and ask your provider to confirm.
Then restart PHP. After that, undo the temporary settings: php php2shell.php --undo. In particular, you want memory_limit back to a normal value.
Source: php.net