PHP security advisory

ITRS has reviewed two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also known as php2shell. These vulnerabilities could potentially allow an attacker to run malicious code on an affected system.

Note

This update applies to Opsview On-Premises. Opsview does not include its own PHP packages. The operating system installs and updates PHP. PHP-FPM runs only on the Orchestrator, so Collectors are not affected.

Each section below gives the security update for one operating system. Older operating systems that no longer receive security updates have a temporary mitigation.

  1. Make sure a backup is available before you change the system.
  2. During a planned maintenance window, follow the section for your operating system.
  3. Complete the checks at the end of this page.

Ubuntu 22.04 (PHP 8.1) Copied

Ubuntu 22.04 uses PHP 8.1. The patched package is 8.1.2-1ubuntu2.28 (USN-8948-1).

On the Orchestrator, refresh the package list and upgrade the installed PHP 8.1 packages:

sudo apt-get update
sudo apt-get install --only-upgrade 'php8.1-*'

PHP-FPM restarts automatically during the update.

Debian 12 (PHP 8.2) Copied

Debian 12 uses PHP 8.2. The patched package is 8.2.35-1~deb12u1 (DLA-4848-1).

On the Orchestrator, refresh the package list, upgrade the installed PHP 8.2 packages, and restart PHP-FPM:

sudo apt-get update
sudo apt-get install --only-upgrade 'php8.2-*'
sudo systemctl restart php8.2-fpm

RHEL 8 Copied

RHEL 8 enables PHP 7.2 by default. That version is unpatched. A module stream is the PHP version the operating system is set to install. Switch to the PHP 7.4 stream. The patched package is 7.4.33-8 (RHSA-2026:87080).

On the Orchestrator, switch to PHP 7.4, upgrade the PHP packages, and restart PHP-FPM:

sudo dnf module reset php
sudo dnf module enable php:7.4
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

RHEL 9.7 or later Copied

RHEL 9.7 or later uses PHP 8.0. Update PHP to package 8.0.30-8 or later (RHSA-2026:87151).

On the Orchestrator, upgrade the PHP packages and restart PHP-FPM:

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

Oracle Linux 8 Copied

Oracle Linux 8 enables PHP 7.2 by default. That version is unpatched. If the Orchestrator is using PHP 7.2, switch to the PHP 7.4 stream. The patched package is 7.4.33-8 (ELSA-2026-87080).

  1. On the Orchestrator, check which PHP stream is enabled:

    sudo dnf module list php --enabled

  2. If the enabled stream is PHP 7.2, switch to PHP 7.4:

    sudo dnf module reset php
sudo dnf module enable php:7.4

    If PHP 7.4 is already enabled, skip this step.

  3. Update the PHP packages and restart PHP-FPM:

    sudo dnf distro-sync 'php*'
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

Oracle Linux 9 Copied

Oracle Linux 9 uses the default PHP 8.0 packages. The patched package is 8.0.30-8.el9_8.1 (ELSA-2026-87151).

On the Orchestrator, upgrade the PHP packages and restart PHP-FPM:

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

Do not switch to the PHP 8.1, 8.2, or 8.3 module streams. Those streams are unpatched.

If another PHP module stream is enabled, dnf module list php shows that stream as enabled [e]. Return to the default packages first:

sudo dnf module reset -y php
sudo dnf distro-sync -y 'php*'
sudo systemctl restart php-fpm

Then confirm that the default PHP 8.0 fixed build is installed. Use the checks in Confirm the update.

Operating systems without a standard package fix Copied

On the operating systems below, standard security packages do not include this fix.

The PHP settings can reduce exposure until you upgrade. See the PHP advisory published on 21 October 2026. These settings do not fix the vulnerability. Upgrade the operating system as described in the section for your system.

Add the settings for your operating system.

Ubuntu 20.04 Copied

Ubuntu 20.04 is supported only on Opsview 6.11 and has reached end of life. Standard security packages do not provide a fix without Ubuntu Pro extended support.

To resolve the vulnerability, upgrade to Ubuntu 22.04 using the standard Ubuntu upgrade procedure, then apply the Ubuntu 22.04 PHP update above.

Until you upgrade, add these settings to the active Opsview PHP-FPM pool.

Confirm that PHP 7.4 is installed:

sudo apt list --installed | grep php

Create /etc/php/7.4/fpm/pool.d/zz-opsview-hardening.conf with the following contents:

[opsview-pool]
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M
php_admin_value[upload_max_filesize] = 2M
php_admin_flag[session.upload_progress.enabled] = off

Restart PHP-FPM:

sudo systemctl restart php7.4-fpm

This reduces exposure but does not fix the vulnerability.

Debian 10 Copied

Debian 10 is supported only on Opsview 6.10 and has reached end of life. Standard security packages do not provide a fix without extended long-term support.

Note

To resolve the vulnerability, upgrade to Debian 12, then apply the Debian 12 PHP update above. For more information, see Upgrade from Debian 10 to 12.

Until you upgrade, add these settings to the active Opsview PHP-FPM pool.

Confirm that PHP 7.3 is installed:

sudo apt list --installed | grep php

Create /etc/php/7.3/fpm/pool.d/zz-opsview-hardening.conf with the following contents:

[opsview-pool]
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M
php_admin_value[upload_max_filesize] = 2M
php_admin_flag[session.upload_progress.enabled] = off

Restart PHP-FPM:

sudo systemctl restart php7.3-fpm

This reduces exposure but does not fix the vulnerability.

Confirm the update Copied

The operating system vendor can backport the fix without changing the PHP version reported by php -v. Check the installed package changelog for CVE-2026-109618, and confirm that PHP-FPM restarted.

On Ubuntu or Debian, adjust the PHP branch in the path. This example uses php8.1:

zcat /usr/share/doc/php8.1-common/changelog.Debian.gz | grep CVE-2026-109618

On RHEL or Oracle Linux:

rpm -q --changelog php-fpm | grep CVE-2026-109618

A printed line shows that the package changelog includes CVE-2026-109618.

Check that PHP-FPM is running:

# RHEL or Oracle Linux
systemctl status php-fpm

# Debian 12
systemctl status php8.2-fpm

# Ubuntu 22.04
systemctl status php8.1-fpm

After the service is running, confirm that you can log in to Opsview. If you use NetAudit, validate that the page loads correctly.

["Opsview On-Premises"] ["Release Notes"]

Was this topic helpful?