Problem: UCS 5.2 - Remediation of CVE-2026-109618 & CVE-2026-109619 (PHP2Shell Vulnerability)

Knowledge Base Community
, , , ,
1

Problem

A critical Remote Code Execution (RCE) security vulnerability affecting PHP commonly referred to as PHP2Shell and tracked under CVE-2026-109618 (alongside associated tracking under CVE-2026-109619) has been identified. Systems running unpatched instances of php8.2 on UCS 5.2 are vulnerable to potential exploitation.

Root Cause

The vulnerability stems from inadequate input validation and sanitization within core components of the PHP engine. An unauthenticated or low-privileged attacker can craft malicious requests to trigger arbitrary code execution in the context of the running PHP web server worker process.

Detailed information and official tracker details can be found at:

Solution

To remediate this vulnerability, administrators must update the installed php8.2 packages to version 8.2.35-1~deb12u1 or higher.

Follow the step-by-step update process below.

Step 1: Verify Current PHP Package Status

Log in to your UCS 5.2 node via SSH as root and check the currently installed version:

apt-cache policy php8.2

Expected baseline output prior to update:

php8.2:
  Installed: 8.2.31-1~deb12u1
  Candidate: 8.2.31-1~deb12u1

Step 2: Fetch Repository Updates

Update your local APT package lists to ensure the latest patch metadata is available:

apt update

Step 3: Verify the Security Candidate Version

Confirm that the patched candidate version is available in the repository index:

apt-cache policy php8.2

Expected output displaying the new candidate:

php8.2:
  Installed: 8.2.31-1~deb12u1
  Candidate: 8.2.35-1~deb12u1

Step 4: Perform the Targeted PHP Update

Execute a targeted upgrade for all PHP-related packages on the system:

apt --only-upgrade install "^php.*"

Verification

After completing the upgrade, confirm that the update was applied successfully by inspecting the APT policy for php8.2:

apt-cache policy php8.2

Expected Successful Output:

root@Bremen:~# apt-cache policy php8.2
php8.2:
  Installed: 8.2.35-1~deb12u1
  Candidate: 8.2.35-1~deb12u1
  Version table:
 *** 8.2.35-1~deb12u1 500
        500 https://updates.software-univention.de errata526/main amd64 Packages
        100 /var/lib/dpkg/status
     8.2.31-1~deb12u1 500
        500 https://updates.software-univention.de ucs526/main amd64 Packages

Optionally, verify the running CLI PHP version:

php -v

PHP 8.2.35 (cli) (built: Oct 21 2026 06:29:51) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.35, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.35, Copyright (c), by Zend Technologies

References