PHP Vulnerability: PHP2SHELL Patching Guide
Hide your wife, hide your kids, php2shell is all up in here!
The latest PHP CVE's that dropped today are gnarly. Gear up your DevOps engineers because it's gonna be a rough one if you haven't patched your systems already.
Mitigation Steps
You need to take specific steps depending on your version of PHP.
Step 1. Determine your OS version.
lsb_release -a
example
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.04.5 LTS
Release: 24.04
Codename: noble <- This is the important part
Step 2. Determine the version of PHP on your server.
dpkg -l | grep php
example
ash@bulbasaur:~$ dpkg -l | grep php
ii libapache2-mod-php8.4 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 server-side, HTML-embedded scripting language (Apache 2 module)
ii php-common 2:101+0~20261021.78+ubuntu22.04~1.gbp53f25f all Common files for PHP packages
ii php8.4 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 all server-side, HTML-embedded scripting language (metapackage)
ii php8.4-bcmath 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 Bcmath module for PHP
ii php8.4-cli 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 command-line interpreter for the PHP scripting language
ii php8.4-common 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 documentation, examples and common module for PHP
ii php8.4-curl 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 CURL module for PHP
ii php8.4-intl 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 Internationalisation module for PHP
ii php8.4-mbstring 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 MBSTRING module for PHP
ii php8.4-opcache 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 Zend OpCache module for PHP
ii php8.4-readline 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 readline module for PHP
ii php8.4-sqlite3 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 SQLite3 module for PHP
ii php8.4-xml 8.4.27-1+0~20261021.57+ubuntu22.04~1.gbp7636b9 amd64 DOM, SimpleXML, XML, and XSL module for PHP
PHP <= 7.4., <= 8.1.
Update to at least PHP 8.2 (go for 8.5 if you can). You will need to evaluate your project's source code and dependencies. This is the worst case scenario.
PHP 8.2., 8.3., 8.4., 8.5.
There is a repository serving patched Debian packages. This can be used on any Debian flavor (i.e. Ubuntu). These are the minimum PHP versions that have the patch: 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Step 3. Setup the PHP package repository. See [
Razuuu/deb-sury-org-php.sh](https://gist.github.com/Razuuu/f646c3be44c5ba3b9c8e38b0a856d7b4)
#!/bin/bash
# Debian Repository not available for forky (yet)
DISTRO=$(lbs_release -a | grep Codename | cut -f2)
if [ "${DISTRO}" == "forky" ]; then DISTRO="bookworm"; fi
# Install dependencies
apt update
apt install apt-transport-https ca-certificates curl -y
# Download gpg key
curl -sSLo /usr/share/keyrings/deb.sury.org-php.gpg https://packages.sury.org/php/apt.gpg
# Add Debian Repository
echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ ${DISTRO} main" > /etc/apt/sources.list.d/deb.sury.org.list
Step 4. Update apt packages
sudo apt update
Step 5. Install PHP
PHP_VERSION="php8.5" # Or your current version: 8.2, 8.3, 8.4, 8.5
PHP_PACKAGES="libapache2-mod-$PHP_VERSION $PHP_VERSION $PHP_VERSION-mysql ..." # All your PHP packages from dpkg -l | grep php
sudo apt install $PHP_PACKAGES
Step 6. Verify the patched version is running
php --version
# Verify with PHPInfo
echo '<?php phpinfo(); ' | sudo tee /var/www/html/info.php # Or somewhere else in your webroot
# ... visit http://example.com/info.php
# Ensure php version is correct, then cleanup
sudo rm /var/www/html/info.php
Final Thoughts
If you're using a cloud platform provider, like Google Cloud Platform or AWS, it's always a good idea to take a snapshot of your system before you start the upgrade. And, in some cases you may have to do a complete dist-upgrade to upgrade your whole system.
If it makes you feel any better, approximately 69% to 75% of the Internet is in the same boat.
Happy patching!