Blog

October 22, 2026

How to Secure Your PHP Infrastructure and Remediate PHP2Shell with Puppet

Nico Krüger
Nico Krüger

Security & Compliance,

How to & Use Cases

Back to top

What is PHP? 

PHP is one of the most widely used open-source back-end programming languages which run web sites around the world. Platforms like Wikipedia, online shops, and WordPress – the system behind many websites. 

It has also been used to write tools that speed up web app creation like Laravel, Symfony, and Drupal all of which are used globally. 

According to the cyber-security firm, Wiz, PHP covers 70% of the world's websites. PHP is maintained by a non-profit called the PHP Foundation. 

Back to top

What is the php2shell Vulnerability? 

The detailed flaw coined “php2shell” is inherent in the PHP language itself, with multiple versions of PHP affected that have been released on the last decade. 

Ryan Austin, a Calif researcher who helped uncover the issue told the BBC it was, “The most serious vulnerability I’ve ever found". Wiz wrote in a blog post about the detailed findings that would allow hackers to exploit the PHP2Shell issue and take control of an affected web server. 

Back to top

How Do You Know if You Are Affected? 

Every PHP version released over the last decade (going back to PHP5, including PHP8.1 and older which lack official patches) is potentially vulnerable. 

Compare your running version against the fixed releases issues Oct 21st, 2026. 

  • PHP 8.5: You need 8.5.12 or higher 
  • PHP 8.4: You need 8.4.27 or higher 
  • PHP 8.3: You need 8.3.36 or higher 
  • PHP 8.2: You need 8.2.35 or higher 
  • PHP 8.1 or older: There is no official fix; you must upgrade immediately 

For legacy PHP environments, Perforce Zend has patches immediately available for key end-of-life PHP versions 7.2, 7.3, 7.4, 8.0, and 8.1. ZendPHP helps organizations address critical vulnerabilities like PHP2Shell without requiring an immediate application migration or rewrite.
Explore ZendPHP

Back to top

How to Check your PHP Version

Linux / Dedicated Server via CLI: Run php -v. (Note: Ensure you verify the version actively serving web requests rather than just the command-line binary, as they can differ.)  

Docker: Run docker compose exec <service_name> php -v.  

WordPress: Go to Tools > Site Health > Info and look under the Server section. (Remember: Updating WordPress or its plugins does not update the underlying PHP engine.)  

Shared Hosting: Check your control panel (such as cPanel's MultiPHP Manager) or ask your host provider if your plan has been patched for CVE-2026-109618 and CVE-2026-109619.  

Linux Distributions (Ubuntu, Debian, Cloud Linux): Check your vendor's security advisory, as distros frequently backport security fixes without changing the public version string.

Back to top

How Does Puppet Help With php2shell? 

PHP2Shell is the nickname for the two critical PHP core flaws CVE-2026-109618 and CVE-2026-109619. The Puppet agent is the best solution to patch and verify your entire service fleet running PHP. 

Back to top

How to Roll Out the Patched Packages for PHP With Puppet

If PHP is already managed in your manifest, raise the version there: 

package { ['php8.3-fpm', 'php8.3-cli', 'php8.3-common']: 
	ensure => '8.3.36-1',   # or 'latest' if you're comfortable with tha 
	notify => Service['php8.3-fpm'], 
} 

  

service { 'php8.3-fpm': 
	ensure => running, 
	enable => true, 
}

Screenshot of PE packages list

  • Upgrade all PHP packages together, including extensions. The Pterodactyl release notes say to upgrade every PHP package at once. 

  • The notify matters. A running PHP-FPM, Apache mod_php or similar process keeps the old code in memory until it restarts. One advisory summary says to restart every PHP worker after patching.

  • Roll out in waves (noop run first, then internet-facing servers, then the rest) using environments, node groups or --tags.

Back to top

Need to Secure Your Infrastructure and Reduce your Time to Resolution for Critical CVE’s?  

Contact team today and we can show you how Puppet not only helps patch critical CVE’s but also helps to ensure end-to-end fleet compliance and configuration management for all your Linux, Windows and Cloud Hosted servers. 

Meet with a Puppet Expert  See Puppet in your Environment 

Back to top