PHP security update
PHP on the OP5 Monitor server must be updated to address these PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Both vulnerabilities allow unauthenticated remote code execution.
OP5 Monitor uses the PHP packages supplied by the operating system. Apply the update with the operating system package manager on the OP5 Monitor server.
| Situation | What the user does |
|---|---|
| Fresh installation or upgrade on or after 22 October 2026 for OP5 Monitor 9.x or 10.x | The fixed PHP version is already included. No manual PHP steps are required, but confirm that the installed PHP version is the fixed version or later. For OP5 Monitor 10.x and 9.18 and later, use PHP 8.2.35 or later. For OP5 Monitor 9.17 and earlier, use PHP 7.4.33-8 or later. |
| Existing installation from before 22 October 2026 | Follow the manual steps for your OP5 Monitor version below. This applies to 10.x and 9.x systems installed before the fix, including earlier 9.x versions. |
For supported platforms, see PHP security update in the OP5 Monitor 10.x Compatibility Matrix. For other changes in the current release, see OP5 Monitor 10.x Release Notes.
OP5 Monitor 10.x, and OP5 Monitor 9.18 and later Copied
Note
If you are using OP5 Monitor 9.18 or OP5 Monitor 9.19, once the steps below are performed, the OP5 Monitor version will also be updated to the latest 9.x patch version.
Clear the package cache and download a fresh package catalog before you update. If you skip this, the update can use a cached catalog and treat an older PHP package as the latest.
Run the following commands on the OP5 Monitor server:
sudo dnf clean all && dnf makecache
sudo dnf update -y --exclude=infrastructure-agent
sudo systemctl restart php-fpm httpd
The update command excludes the infrastructure-agent package. systemctl restart php-fpm httpd restarts both php-fpm and httpd.
After the services restart, check the PHP version:
php -v
Sample output:
PHP 8.2.35 (cli) (built: Oct 19 2026 07:29:52) (NTS gcc x86_64)
Copyright (c) The PHP Group
Zend Engine v4.2.35, Copyright (c) Zend Technologies
with Zend OPcache v8.2.35, Copyright (c), by Zend Technologies
OP5 Monitor 9.17 and earlier Copied
OP5 Monitor 9.17 and earlier use PHP 7.4. Install the security advisory for the operating system, then restart php-fpm and httpd.
Note
These steps cover RHEL and Rocky Linux.
RHEL Copied
Check the operating system and the installed PHP package, apply the RHEL advisory, restart php-fpm and httpd, and then check the package again:
cat /etc/redhat-release
rpm -q php-cli
sudo dnf update --refresh --advisory=RHSA-2026:87080
sudo systemctl restart php-fpm httpd
rpm -q php-cli
On RHEL, the PHP package before the update looks like this:
php-cli-7.4.33-6.module+el8.10.0+24605+5caacdec.x86_64
On RHEL, the PHP package after the update looks like this:
php-cli-7.4.33-8.module+el8.10.0+25117+30337cca.x86_64
Rocky Linux Copied
Check the operating system and the installed PHP package, apply the Rocky Linux advisory, restart php-fpm and httpd, and then check the package again:
cat /etc/redhat-release
rpm -q php-cli
sudo dnf update --refresh --advisory=RLSA-2026:87080
sudo systemctl restart php-fpm httpd
rpm -q php-cli