Ubuntu has released fixes for php2shell (CVE-2026-109618 and CVE-2026-109619), a critical unauthenticated remote-code-execution issue in PHP applications rated 9.2 on CVSS 4.0.
Coverage spans Ubuntu 14.04 LTS through 26.10; Ubuntu Pro is required for 14.04, 16.04 and 18.04 LTS.
PHP applications may need a manual restart if the system is not fully restarted.
The release also addresses a separate eMudhra certificate issue.
The problem in PHP applications
The issue, known as php2shell, involves two security vulnerabilities. It was rated critical, with a score of 9,2. On October 21, 2026, many websites were taken down to fix it.
The updates cover Ubuntu versions from 14.04 to 26.10. Versions 14.04, 16.04, and 18.04 LTS require Ubuntu Pro to install. If a full computer restart is not possible, it is recommended to manually restart applications that use PHP.
The issue with eMudhra certificates
Digital certificates help browsers verify that a website is who it claims to be. If the eMudhra system is compromised, fake certificates can be created.
READ ALSO
Two security holes in PHP and hacking attempts are already being recorded
Google, Microsoft, Apple, and Mozilla have already revoked the affected eMudhra certificates.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
