PHP Vulnerability: Update Steps for Ubuntu Systems

23 October 2026

This announcement is a follow-up to our announcement about the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, PHP2Shell) and summarizes the steps for our systems running Ubuntu. Ubuntu released fixed packages for these vulnerabilities on 21 October 2026.

Important: Ubuntu applies security patches without raising PHP’s version number. For this reason, after the update, the php -v command may still show 8.3.6 or 8.1.2. Do not use php -v to check whether the patch has been applied; check the package version shown below instead.

Ubuntu 24.04 LTS

Refresh the package list and install the updates:

sudo apt update
sudo apt upgrade

Restart the system. The updated PHP takes effect after the system is restarted. During the restart, the services on the system are briefly interrupted, so do it at a suitable time:

sudo reboot

Verify. The package version should be 8.3.6-0ubuntu0.24.04.13 or newer:

dpkg -s php8.3-common | grep '^Version'

Ubuntu 22.04 LTS

On Ubuntu 22.04, the PHP version is 8.1. The steps are the same:

sudo apt update
sudo apt upgrade

Then restart the system:

sudo reboot

Verify. The package version should be 8.1.2-1ubuntu2.28 or newer:

dpkg -s php8.1-common | grep '^Version'

Ubuntu 20.04 LTS and older versions

Standard security support for Ubuntu 20.04 and older versions has ended. For these vulnerabilities, fixed packages are provided on these versions only with a paid Ubuntu Pro (ESM) subscription. The lasting and correct solution is to upgrade the operating system to a supported, current Ubuntu version.

An operating system upgrade may affect the applications and configuration on the system. Do not perform it without first taking a backup and testing. Get support from us for the upgrade; you can reach us using the contact details below.

Update your Q-smart application as well

After updating PHP, update your Q-smart application as well; the current Q-smart version works compatibly with the new PHP. Q-smart updates are free and we provide lifetime update support. Get support from our technical support team to update your application.

Technical support

If you do not want to perform the update yourself, are unsure of your system’s Ubuntu version, or need an operating system upgrade, contact our company to get technical support: our contact page.

Sources: Ubuntu Security Team, CVE-2026-109618 and CVE-2026-109619 pages (USN-8948-1 and USN-8948-2, 21 October 2026).