# PHP2Shell: Patching PHP on Trellis Servers

PHP shipped a security release on October 21 for two critical vulnerabilities now known as [PHP2Shell](https://www.php2shell.com/). Both allow remote code execution without logging in.

Every WordPress site on PHP-FPM is affected. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

## The vulnerabilities

PHP announced the security release on October 20, a day ahead of time, without details. The fixes and advisories followed on October 21:

- [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w): memory corruption when a request runs out of memory
- [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp): use-after-free from state left over between requests

The vulnerabilities were found by researchers at Wiz, OpenAI, and Calif (who demonstrated the attack against WordPress). PHP confirmed it works against PHP-FPM which is what Trellis uses.

## Upgrading PHP on Trellis

Trellis installs PHP with `apt_package_state: present`, which installs packages but never upgrades them, so re-provisioning alone won't pick up the patch.

First, update to [Trellis v1.32.1](https://github.com/roots/trellis/releases/tag/v1.32.1). If you'd rather not upgrade all of Trellis right now, the discussion below has steps for applying just the PHP role changes.

Next, disable session upload progress. PHP's advisory recommends turning it off even after patching if you don't use it, and WordPress doesn't. Trellis doesn't have a variable for this setting, so add it to `roles/php/templates/php-fpm.ini.j2`, under the other `session.*` lines:

```
session.upload_progress.enabled = Off
```

Then provision to upgrade PHP:

```
trellis provision --extra-vars apt_package_state=latest --tags php production
```

Finally, restart PHP-FPM on the server and confirm the version:

```
sudo service php8.4-fpm restart && php -v
```

Swap `8.4` for your `php_version`. You should see 8.4.27 (or 8.3.36, 8.5.12, 8.2.35). Repeat for staging and development.

## Trellis moved to packages.sury.org

Trellis has long installed PHP from Ondřej Surý's Launchpad PPA (`ppa:ondrej/php`). Ondřej also maintains [packages.sury.org](https://packages.sury.org/php/), which is the repository he now recommends, and a move was already in the works after a PPA metadata change started causing an interactive prompt during `apt update` ([\#1678](https://github.com/roots/trellis/issues/1678)).

[Trellis v1.32.0](https://github.com/roots/trellis/releases/tag/v1.32.0) made the switch ([\#1680](https://github.com/roots/trellis/pull/1680)) on release day because packages.sury.org had the patched builds well before the PPA did.

[v1.32.1](https://github.com/roots/trellis/releases/tag/v1.32.1) fixed removal of the old PPA on existing servers ([\#1696](https://github.com/roots/trellis/pull/1696)). With the PPA still configured and overloaded, provisioning could hang on the "Add Sury PHP repository" task.

## Not using Trellis?

Run `php -v` on your server or check with your host. Any version below the ones listed above is vulnerable. If you can't upgrade right away, disabling `session.upload_progress.enabled` reduces your exposure in the meantime.

## More info

- [PHP's security release announcement](https://www.php.net/archive/2026.php#2026-10-21-5)
- [The PHP Foundation's post on the release](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)
- [PHP2Shell](https://www.php2shell.com/), from the researchers
- CVE-2026-109618 ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)) and CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp))

Questions or problems upgrading? Let us know!