PHP2Shell（CVE-2026-109618 与 CVE-2026-109619）：漏洞详解及服务器修补指南

# Command-line PHP
php -v

# Every PHP binary installed on the server
ls /usr/bin/php* /usr/sbin/php-fpm* /opt/cpanel/ea-php*/root/usr/bin/php /opt/alt/php*/usr/bin/php 2>/dev/null

# The version your web server serves: drop a temporary file, fetch it, then delete it
echo '<?php echo PHP_VERSION;' | sudo tee /var/www/html/v.php >/dev/null
curl -s https://your-domain.com/v.php; echo
sudo rm /var/www/html/v.php

sudo apt update
sudo apt install --only-upgrade 'php*-common' 'php*-cli' 'php*-fpm' 'libapache2-mod-php*'

# Restart PHP-FPM (repeat for each installed version)
sudo systemctl restart php8.3-fpm

# Using mod_php? Restart Apache instead
sudo systemctl restart apache2

# Confirm
php -v

sudo dnf clean all
sudo dnf upgrade 'php*'

# Restart PHP-FPM and the web server
sudo systemctl restart php-fpm
sudo systemctl restart httpd   # or nginx

php -v

# CloudLinux / CentOS 7
yum clean all && yum update "ea-php*"

# AlmaLinux / CloudLinux 8, 9 and 10
dnf clean all && dnf upgrade "ea-php*"

# Restart PHP-FPM for all accounts, then Apache or LiteSpeed
/scripts/restartsrv_apache_php_fpm
/scripts/restartsrv_httpd

# Check each installed version
for p in /opt/cpanel/ea-php*/root/usr/bin/php; do echo -n "$p: "; $p -r 'echo PHP_VERSION, PHP_EOL;'; done

yum clean all && yum update 'alt-php*' 'ea-php*' -y

# Confirm the fix is in the installed package (example: alt-php 7.4)
rpm -q --changelog alt-php74 | grep -m1 -i 'CVE-2026-109618'

# Pin to a fixed release (or newer)
FROM php:8.3.36-fpm

# ...your existing build steps

docker pull php:8.3.36-fpm
docker compose build --pull
docker compose up -d

# Confirm inside the running container
docker compose exec app php -v

; /etc/php/8.3/fpm/conf.d/99-php2shell.ini  (adjust the path to your version)
; Interim mitigation for CVE-2026-109618 / CVE-2026-109619

memory_limit = -1
session.upload_progress.enabled = 0
post_max_size = 1M

; PHP 8.5 only
fatal_error_backtraces = 0

; /etc/php/8.3/fpm/pool.d/www.conf
php_admin_value[memory_limit] = -1
php_admin_flag[session.upload_progress.enabled] = off

# Cap PHP-FPM memory with systemd
sudo systemctl edit php8.3-fpm
#   [Service]
#   MemoryMax=2G

# Or, for Docker:
docker update --memory 2g --memory-swap 2g <container>

# nginx: inside http {} or server {}
client_max_body_size 1m;

# Allow bigger uploads only where needed, e.g. the WordPress media uploader
location = /wp-admin/async-upload.php {
    client_max_body_size 64m;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

# Apache: in the vhost or .htaccess (bytes)
LimitRequestBody 1048576

sudo systemctl restart php8.3-fpm
sudo systemctl reload nginx   # or: sudo systemctl restart apache2

sudo grep -R "Allowed memory size of .* exhausted .* in Unknown on line 0" \
  /var/log/php*-fpm.log /var/log/apache2/error.log /var/log/httpd/error_log \
  /var/log/nginx/error.log 2>/dev/null | tail -n 50

# Apache children dying with segfaults
sudo grep -R "AH00052: child pid .* exit signal Segmentation fault" /var/log/apache2/ /var/log/httpd/ 2>/dev/null

# PHP-FPM workers killed by signals
sudo grep -R "exited on signal" /var/log/php*-fpm.log 2>/dev/null

# A shell running under apache, www-data or php-fpm is a red flag
ps aux | grep -E "(apache|www-data|php-fpm|nobody)" | grep -E "\b(sh|bash|dash)\b" | grep -v grep

# Unexpected outbound connections from the web user
sudo ss -tunp | grep -E "php|apache|httpd|nginx"

# PHP files changed in the last 7 days
sudo find /var/www -type f -name "*.php" -mtime -7 -printf "%TY-%Tm-%Td %TH:%TM  %p\n" | sort -r | head -n 50

# PHP files in upload folders (they should never be there)
sudo find /var/www -path "*uploads*" -name "*.php"

# Cron jobs added for the web user
sudo crontab -u www-data -l 2>/dev/null; sudo crontab -u apache -l 2>/dev/null

• PHP
• CVE-2026-109618
• CVE-2026-109619
• PHP2Shell
• 服务器安全
• cPanel
• WordPress 安全

关于作者Robert S.WebGee Cloud & Infra Expert

Robert S. 的全部文章

技术审核：Rickey Shanahan, Sr. Support Engineer