PHP2Shell: Patching PHP on Trellis Servers

Ben Word 2026-10-22

PHP shipped a security release on October 21 for two critical vulnerabilities now known as PHP2Shell. Both allow remote code execution without logging in.

Every WordPress site on PHP-FPM is affected. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

The vulnerabilities

PHP announced the security release on October 20, a day ahead of time, without details. The fixes and advisories followed on October 21:

CVE-2026-109618: memory corruption when a request runs out of memory
CVE-2026-109619: use-after-free from state left over between requests

The vulnerabilities were found by researchers at Wiz, OpenAI, and Calif (who demonstrated the attack against WordPress). PHP confirmed it works against PHP-FPM which is what Trellis uses.

Upgrading PHP on Trellis

Trellis installs PHP with apt_package_state: present, which installs packages but never upgrades them, so re-provisioning alone won’t pick up the patch.

First, update to Trellis v1.32.1. If you’d rather not upgrade all of Trellis right now, the discussion below has steps for applying just the PHP role changes.

Next, disable session upload progress. PHP’s advisory recommends turning it off even after patching if you don’t use it, and WordPress doesn’t. Trellis doesn’t have a variable for this setting, so add it to roles/php/templates/php-fpm.ini.j2, under the other session.* lines:

session.upload_progress.enabled = Off

Then provision to upgrade PHP:

trellis provision --extra-vars apt_package_state=latest --tags php production

Finally, restart PHP-FPM on the server and confirm the version:

sudo service php8.4-fpm restart && php -v

Swap 8.4 for your php_version. You should see 8.4.27 (or 8.3.36, 8.5.12, 8.2.35). Repeat for staging and development.

Trellis moved to packages.sury.org

Trellis has long installed PHP from Ondřej Surý’s Launchpad PPA (ppa:ondrej/php). Ondřej also maintains packages.sury.org, which is the repository he now recommends, and a move was already in the works after a PPA metadata change started causing an interactive prompt during apt update (#1678).

Trellis v1.32.0 made the switch (#1680) on release day because packages.sury.org had the patched builds well before the PPA did.

v1.32.1 fixed removal of the old PPA on existing servers (#1696). With the PPA still configured and overloaded, provisioning could hang on the “Add Sury PHP repository” task.

Not using Trellis?

Run php -v on your server or check with your host. Any version below the ones listed above is vulnerable. If you can’t upgrade right away, disabling session.upload_progress.enabled reduces your exposure in the meantime.

More info

PHP’s security release announcement
The PHP Foundation’s post on the release
PHP2Shell, from the researchers
CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)

Questions or problems upgrading? Let us know!