PHP2Shell Fix: Patch CVE-2026-109618 in One Command

To fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619), every PHP on the server has to end up on a patched build: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or a distribution package that carries the fix as a backport. WizeB published a free, open-source script that does this in one command: curl -fsSL https://php2shell.wizeb.com/autofix | sudo bash (on a Mac with Homebrew, run it without sudo). It finds every PHP install on the machine, patches each one on the version you already run, and restarts PHP so the fix actually takes effect. Run it with --dry-run first to see the plan without changing anything.

This post covers two things: how to patch PHP2Shell safely, and what building the fix taught us about using AI for urgent operations work. If you are deciding where AI fits in your business more broadly, start with our guide at wizeb.com/blog/how-to-implement-ai-agents-in-business.

The Problem: A Critical PHP Bug and a Messy Fleet

PHP2Shell was disclosed on 21 October 2026: two unauthenticated remote code execution bugs in PHP. Unauthenticated means an attacker doesn't need an account. Remote code execution means they can run their own commands on your server. That combination is why this one can't wait for the next maintenance window.

The fix itself is simple on paper: upgrade PHP. In practice, very few servers have one clean PHP install. A typical business server or hosting box can have several PHP versions side by side, a control panel with its own PHP builds, a Homebrew install on a developer's Mac, and Docker containers with PHP baked into the image. Three things make the obvious fix risky:

• Version checks lie. Distributions such as Ubuntu and Rocky often ship the security fix as a backport while keeping the old version number, so php -v can show an old version on a server that is already safe, and teams waste time upgrading what was fine.
• Upgrading the major version breaks apps. Moving an old PHP 7.4 application to PHP 8 to get the fix can take the application down, which is a different outage from the one you were trying to prevent.
• Patched packages don't help until PHP restarts. PHP-FPM, Apache and LiteSpeed keep running the old binary in memory until they are restarted.

Doing this by hand across a fleet means checking each server, each PHP install and each package changelog, then deciding per server. That is days of careful work for an operations team, during exactly the window when attackers are scanning for unpatched hosts.

How to Patch PHP2Shell in One Command

Here is the safe order of operations with php2shell-autofix. The full documentation and source code are on GitHub at github.com/rahnas/php2shell-autofix, and php2shell.wizeb.com points to the same repository.

1. 1Verify the script (recommended). Download it with curl -fsSL https://php2shell.wizeb.com/autofix -o php2shell-fix.sh, then check it against the published checksum: curl -fsSL https://raw.githubusercontent.com/rahnas/php2shell-autofix/main/SHA256SUMS | sha256sum -c - (on macOS use shasum -a 256 -c instead). It should print OK.
2. 2Do a dry run. Run curl -fsSL https://php2shell.wizeb.com/autofix | sudo bash -s -- --dry-run. It reports every PHP it found, which are vulnerable and what it would do, and changes nothing.
3. 3Run the fix. Run curl -fsSL https://php2shell.wizeb.com/autofix | sudo bash, or sudo bash php2shell-fix.sh if you downloaded and verified it. Most servers need nothing more.
4. 4Read the summary. Exit code 0 means everything is safe; 1 means something still needs attention, and the summary tells you what. The full log is in /var/log/php2shell-fix.log (on macOS, ~/Library/Logs/php2shell-fix.log).

What the PHP2Shell Fix Actually Does

The script always takes the least invasive fix that works and only escalates when the step before it fails:

1. 1Find every PHP: distro packages (all versions side by side), cPanel ea-php, CloudLinux alt-php, Plesk, Remi SCL, LiteSpeed lsphp, Homebrew, MAMP/Herd/MacPorts, source builds, FrankenPHP and running Docker containers.
2. 2Check each one against the fixed release, or look for both CVE ids in the package changelog to recognise a distro backport. Safe installs are not touched.
3. 3Patch in place from the repositories you already use, upgrading only that branch's PHP packages. It never runs a full system upgrade.
4. 4If your distro has no fix, add Ondřej Surý's repository (Debian/Ubuntu) or Remi Collet's (RHEL, Alma, Rocky and Oracle 8 and 9) and patch the same PHP version. A 7.4 server stays on 7.4. If that repository has no fix either, it is removed again.
5. 5Anything still vulnerable gets a temporary mitigation (session.upload_progress.enabled = 0 in a drop-in ini file). This blocks only part of the attack, and it is removed automatically on a later run once PHP is patched.
6. 6Restart PHP-FPM, Apache and LiteSpeed, and confirm no process is still running the old binary.

Docker containers are reported with the image to rebuild, never modified. cPanel and Plesk per-site PHP versions are left alone, with a note on where to switch them.

When no patched build exists for your version

Sometimes there is no patched build of your PHP version for your OS, for example PHP 7.4 on Ubuntu 20.04 without Ubuntu Pro. The summary then says so, applies the temporary mitigation and names the option for staying on your version: Ubuntu Pro (free for up to five machines) on Ubuntu 16.04 to 20.04, Freexian ELTS on Debian 9 to 11, or TuxCare/Zend elsewhere.

If you would rather upgrade PHP, --force moves it to a supported branch (8.3 by default). Add --project /var/www/app and it first scans your code with PHPCompatibility and lists what will break. It installs the same extensions, carries over php.ini settings, keeps PHP-FPM socket paths so nginx and Apache configs need no change, leaves the old branch installed, and --rollback undoes it. Don't use --force just in case: it changes your PHP version, and old apps can break.

The Business Lesson: Where AI Engineering Pays Off Fastest

We built php2shell-autofix with AI coding agents under our engineers' direction and published it within a day of disclosure. The interesting part isn't speed for its own sake. It is what the speed bought: time to handle the cases a rushed manual script would skip.

• Breadth. A script that handles one distro is quick to write. Covering Debian, Ubuntu, RHEL-family, Alpine, cPanel, Plesk, LiteSpeed, Homebrew and Docker is where hand-written emergency scripts usually stop. AI agents drafted and revised the per-platform paths while engineers made the decisions.
• Testing. The release was run against a matrix of real scenarios before publishing: Ubuntu 20.04, 22.04 and 24.04, Rocky Linux 9 on both the distro and Remi paths, Alpine 3.18, the official php:7.4-fpm image and a host with containers. On Ubuntu 22.04, for example, it moved PHP 8.1.2 to Surý's patched 8.1.34 without leaving the 8.1 branch.
• Honesty about limits. The README says plainly that the macOS Homebrew path parses and runs on bash 3.2 but has not yet been run on a real Mac. Knowing what wasn't tested is as useful to an operator as what was.

The pattern generalises well beyond PHP. Urgent operations work (security patches, migrations, incident clean-up) is narrow, well-defined and expensive to do slowly, which is exactly where AI-assisted engineering pays off first. We make the same argument for business agents in wizeb.com/blog/ai-agent-strategy-for-ceos: start where the job is clear and the cost of delay is obvious. And as wizeb.com/blog/ai-agent-framework-security-vulnerabilities-2026 shows, attackers now move within hours of a disclosure, so a patch process measured in weeks is a risk in itself.

Example: Patching a Mixed Hosting Fleet

Consider an illustrative case: a small web agency hosting client sites on a handful of servers. One runs Ubuntu 24.04, one is an older Ubuntu 22.04 box with PHP 8.1, one is a Rocky Linux 9 server carrying a legacy PHP 8.0 app, and a developer runs PHP via Homebrew on a Mac. A dry run on each shows the plan. On Ubuntu 24.04 the distro's own fix is applied and its backport recognised. On the 22.04 box, if Ubuntu has no fix for that branch, Surý's patched 8.1 is installed on the same branch. The Rocky server is patched from Rocky's own repository, or from Remi's same-branch build if that isn't available. PHP is restarted on each, and any containers are listed with the image to rebuild. Each client app stays on the PHP version it was built for, and nobody spends the week reading package changelogs.

How WizeB Can Help

WizeB builds software with AI coding agents working under experienced engineers, which is how a fix like this gets designed, tested and shipped in a day rather than a sprint. If your team has an urgent fix, a migration or an internal tool it keeps postponing, see how we work at wizeb.com/services/web-mobile-development. If you want to put AI agents to work on recurring operations and support jobs, start at wizeb.com/services/ai-agents.