On 21 October, php2shell went public: two critical vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They let an attacker run code on the server without logging in, in any PHP application: WordPress, Drupal or a "Hello world". Disclosure was moved forward a day after a leak, so there was no time to wait.
We had a server on Ubuntu 18.04 with PHP 7.2. Current PHP releases include the fix, but PHP 7.2 has been unsupported for years. Canonical published the fix for 7.2, but on 18.04 it only ships through Ubuntu Pro ESM.
We patched it in about 15 minutes. Only the 13 PHP packages changed; nothing else on the system. We hit two problems on the way.
Problem 1: the official check says you have nothing
Canonical suggests this command to see which PHP you have installed:
apt list '?installed ?name(^php[0-9.]+$)'
On 18.04 it prints nothing and reports no error. Those search patterns arrived in apt 2.0 (Ubuntu 20.04); 18.04 ships apt 1.6, which looks for a package with that literal name. It finds none and stays quiet.
Empty output does not mean you are safe. The version that works on 18.04:
apt list --installed 'php*' 'libapache2-mod-php*'
It showed all of PHP 7.2 at 7.2.24-0ubuntu0.18.04.17, older than the fixed build (+esm14). Vulnerable.
Problem 2: the fix is behind Ubuntu Pro
On 18.04 the fix is only in the ESM Infra archive. A normal apt upgrade will never find it.
The first Ubuntu Pro page you reach is a checkout for USD 500 a year. You do not need it: there is a free personal subscription for up to 5 machines, but it lives somewhere else:
- Go to ubuntu.com/pro/dashboard.
- Sign in with a (free) Ubuntu One account.
- Copy the personal token shown there.
The free tier is meant for personal and small-scale use. An organisation with more servers needs a paid plan.
The fix, step by step
1. Attach the machine to Ubuntu Pro without turning anything else on.
sudo pro attach <YOUR_TOKEN> --no-auto-enable
2. Enable ESM Infra only. It adds an apt source and installs nothing.
sudo pro enable esm-infra
3. Confirm the fixed build is available.
sudo apt update
apt-cache policy php7.2-common
# Candidate: 7.2.24-0ubuntu0.18.04.17+esm14
apt will report about 250 pending updates. That is the ESM backlog since 2023. We left it for later: today we only wanted PHP.
4. Simulate before touching anything. -s shows what would change without changing it. Result: 13 upgraded, 0 installed, 0 removed.
sudo apt install -s --only-upgrade php7.2 php7.2-cli php7.2-common php7.2-curl \
php7.2-gd php7.2-json php7.2-mbstring php7.2-mysql php7.2-opcache \
php7.2-readline php7.2-xml php7.2-zip libapache2-mod-php7.2
Adjust the list to the packages the check above showed you.
5. Upgrade for real and restart Apache. With mod_php, Apache keeps running the old code until it restarts.
sudo apt install --only-upgrade php7.2 php7.2-cli php7.2-common php7.2-curl \
php7.2-gd php7.2-json php7.2-mbstring php7.2-mysql php7.2-opcache \
php7.2-readline php7.2-xml php7.2-zip libapache2-mod-php7.2
sudo systemctl restart apache2
How to know it worked
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php7.2-common)" \
ge 7.2.24-0ubuntu0.18.04.17+esm14 && echo "PATCHED" || echo "VULNERABLE"
You can also ask Ubuntu Pro about each CVE. If it is already fixed, nothing changes:
pro fix CVE-2026-109618
pro fix CVE-2026-109619
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618
1 affected source package is installed: php7.2
(1/1) php7.2:
A fix is available in Ubuntu Pro: ESM Infra.
The update is already installed.
✔ CVE-2026-109618 is resolved.
Canonical publishes no exploit test, so verifying means confirming two things: the fixed build is installed, and Apache started after it was.
Sources: php2shell.com, USN-8948-1, USN-8948-2.