PHP

Keeping PHP patched on your own server and in Docker.

• PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619Two critical PHP vulnerabilities fixed on 21 October 2026 can let an attacker run code on your server without logging in. Which versions are fixed, how to check yours, how to update and what to do if you cannot update yet.
• Update PHP in Docker imagesGet a patched PHP into a container: check the PHP version inside it, pull a newer image or rebuild your own, recreate the container and check again.
• Update PHP on Ubuntu or DebianUpdate every installed PHP package on Ubuntu or Debian, from the distribution or from Ondřej Surý's repositories, restart PHP-FPM and check the version of both the command line and PHP-FPM.