PHP2Shell on AlmaLinux: Patched Streams and How to Verify

As of 23 October 2026, AlmaLinux has patched PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in every PHP stream on AlmaLinux 8, 9 and 10, including streams that Red Hat has retired. AlmaLinux's post says the patched packages began "rolling out to the production repositories for every PHP stream on AlmaLinux 8, 9, and 10" at 21:15 UTC on 21 October, before Red Hat had fixed most of them.

To fix a server, run sudo dnf clean metadata && sudo dnf upgrade 'php*', restart PHP-FPM, and confirm the installed build with rpm -q php-common. The tricky part is reading the result. AlmaLinux shipped two kinds of fixed builds: its own early builds, which keep the old PHP version number and end in .alma.1, and Red Hat's later rebuilds, which moved to PHP's fixed releases. Both are fixed. An old version number without the .alma.1 suffix needs checking against AlmaLinux's list before you trust it.

This page lists the fixed builds per stream, the commands AlmaLinux documents, and how to verify without falling into the changelog trap. For Red Hat, Rocky and Oracle Linux, see PHP2Shell on RHEL, Rocky and Oracle Linux.

Fixed AlmaLinux Builds by Release and Stream

Early builds are quoted from AlmaLinux's PHP2Shell post. Later builds come from the AlmaLinux errata site, read on 23 October 2026. Either build in a row is fixed.

Two things stand out. First, AlmaLinux 8's default stream is php:7.2. AlmaLinux says "if you installed PHP there without choosing a stream, that is what you have." Second, the "A" advisories for retired streams were published on the errata site on 23 October, two days after the packages reached the repositories. Red Hat has no fix for those streams, so AlmaLinux is the only source.

Why php -v Can Mislead You on AlmaLinux

AlmaLinux's first fix was a backport into the PHP version each stream already had. So a fixed AlmaLinux 10 server might report PHP 8.3.33, while the upstream fix is in 8.3.36. Later, Red Hat's rebased builds arrived in AlmaLinux's errata, and a server that took those updates reports 8.3.36. Both are fixed.

The safe rule is to read the whole package string. An early fixed build ends in .alma.1. A Red Hat rebuild carries the upstream fixed version (8.2.35, 8.3.36 or 8.4.27). A backported build such as AlmaLinux 9's default PHP 8.0 must match the release in the advisory. Our PHP2Shell version lookup and our guide on how to check your PHP version explain the general method.

How to Update PHP on AlmaLinux

These are AlmaLinux's documented commands:

1. Check which stream you are on: dnf module list php (AlmaLinux 8 and 9).
2. Update PHP: sudo dnf clean metadata && sudo dnf upgrade 'php*'
3. Restart PHP-FPM: sudo systemctl restart php-fpm
4. On AlmaLinux 8 with mod_php, restart Apache instead: sudo systemctl restart httpd
5. Confirm: rpm -q php-common, or rpm -q php8.4-common for PHP 8.4 on AlmaLinux 10.

If the update is not there yet, AlmaLinux says "Most mirrors sync every few hours, so if the update is not available to you yet, try again a little later." Our guide to restarting PHP workers shows how to confirm the processes actually restarted.

Am I Running mod_php?

PHP-FPM is "the default on every AlmaLinux release," and "AlmaLinux 9 and 10 do not ship mod_php." On AlmaLinux 8, AlmaLinux gives this check: httpd -M 2>/dev/null | grep -E 'mpm_|php'. In its words, "If the output includes mpm_prefork_module and php_module or php7_module, that system is running mod_php." PHP's advisory rates mod_php the highest-risk setup, so patch those servers first.

How to Verify the Fix, and When Changelogs Do Not Help

Compare the output of rpm -q php-common with the table above or the advisory. Do not rely on a changelog search alone:

• Red Hat's rebased builds name no CVE. Their changelog entries read "rebase to 8.3.36" and similar, so rpm -q --changelog php-common | grep CVE-2026-109618 (example) returns nothing on a fixed server.
• Backported builds may name the CVEs. Red Hat's php:7.4 and PHP 8.0 builds do. We did not read the changelogs of AlmaLinux's own .alma.1 builds, so do not assume either way.
• Advisory-based tools depend on errata timing. The retired-stream advisories appeared on 23 October. A tool that matches installed packages to advisories, such as dnf updateinfo, could not have reported those fixes before then.

The version string, read against AlmaLinux's own list, is the check that works for every build.

Retired Streams and AlmaLinux Kitten

AlmaLinux went further than Red Hat by patching streams Red Hat retired years ago. It is also clear that this is not a promise: "future fixes for retired streams are not guaranteed." If you are on php:7.2, 7.3 or 8.0 on AlmaLinux 8, or php:8.1 on AlmaLinux 9, treat this patch as time to plan an upgrade to a supported stream. A stream switch changes your PHP version, so test it on a copy first. Our security patching best practices explain how to stage changes like this safely.

AlmaLinux Kitten 10 is not covered yet. AlmaLinux says: "The fix will ride along in the next regular PHP update, so no separate build is being made." As of 23 October we found no confirmation that the update has shipped.

PHP From a Panel, Host or Other Repository

AlmaLinux is explicit about its limits: "Our packages only update PHP installed from AlmaLinux's own repositories. If you get PHP from somewhere else, such as a web hosting control panel, a hosting provider, or a third-party repository, check with that vendor for their fixes and timeline." Many AlmaLinux servers run cPanel's ea-php or Remi's packages. For Remi, see Sury and Remi PHP repositories; for a panel, follow the panel vendor's update. If you have root, patching is your job; on managed hosting, it is your host's. Our guide to the shared responsibility model explains where that line usually falls.

Interim Settings While You Patch

If a server cannot be updated right away, AlmaLinux's post shows how to apply PHP's documented mitigations, for example echo 'session.upload_progress.enabled = 0' | sudo tee /etc/php.d/99-php2shell.ini followed by a PHP-FPM restart. Mitigations reduce exposure but do not make a server safe. After patching, keep that setting: PHP's 23 October advisory for CVE-2026-115560, which affects fully patched releases, recommends it "until the next regular bugfix release." Our guide to PHP2Shell interim mitigations covers the rest.

Conclusion

As of 23 October 2026, AlmaLinux 8, 9 and 10 have fixed PHP in every stream, delivered through the normal repositories. Update with dnf, restart php-fpm (or httpd for mod_php on AlmaLinux 8), and read the full package string: an early .alma.1 build and a later rebased build are both fixed. Kitten 10 is still waiting, and retired streams are patched without a promise of more. If you want a second pair of eyes on a server, our emergency PHP patching team can help. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions