PHP2Shell and Nextcloud: Self-Hosted Files at Risk

As of 23 October 2026, the PHP project has fixed both PHP2Shell flaws in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Nextcloud has published fixed builds for its All-in-One (AIO) container. Exploitation attempts are widely reported, but confirmed successful compromises are not publicly documented, and CISA has not added the flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The direct answer: Nextcloud is one of the applications researchers used to prove the attack works. Calif confirmed unauthenticated remote code execution against Nextcloud 35.0.1. The flaw is in PHP, not in Nextcloud, so what you need is a patched PHP runtime, not a newer Nextcloud. How you get it depends on how you installed Nextcloud: AIO users upgrade AIO, Docker users pull rebuilt images, and everyone else patches the server's PHP and restarts it.

A file server holds an organization's documents, shared links and often its calendars and contacts, so this one deserves same-day attention. For the background, read what PHP2Shell is and who it affects.

What Nextcloud Has Said

Nextcloud responded on GitHub rather than on a blog. On 21 October 2026 it opened and pinned an issue in its server repository, "PHP CVEs. Attention required!", which it closed on 22 October. It says:

• "This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services. The issue allows an attacker to compromise the server and potentially access all its data."
• "The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied."
• "Updated packages are available (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35)."

The first line is Nextcloud's own description of the stakes. Note the wording about CERT: that is Nextcloud's summary. CERT-EU's own advisory says organizations "should consider isolating internet-facing resources from public networks until the fix is applied and verified" if they can't patch right away. Now that fixed PHP exists, the job is to install it, not to keep servers off.

The Dutch national cyber security centre's software inventory lists Nextcloud Server as Vulnerable, noting that "Nextcloud confirms that deployments using affected PHP are at risk."

Why a Nextcloud Server Raises the Stakes

PHP2Shell's confirmed impact is remote code execution as the web server account, the same account that reads and writes your Nextcloud data. CVE-2026-109619 also allows memory disclosure. Wiz, one of the research teams, says leaked memory "may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself."

For a file server, that means documents and sign-in data, not only a defaced home page. Beazley Security advises incident responders to "treat secrets held by an affected PHP process as potentially exposed". If you find signs of compromise, plan to reset admin passwords, revoke app passwords and rotate any keys stored in the server's configuration. Our guide to access control and two-factor authentication covers the account side.

Which Nextcloud Install Do You Run?

Nextcloud is installed in several very different ways, and each gets its PHP from a different place.

"Under investigation" is the Dutch inventory's status for the Snap, NextcloudPi and the community Docker image. It means the PHP dependency is confirmed but a fixed version was not yet recorded.

Nextcloud All-in-One: Upgrade AIO

AIO is maintained by Nextcloud GmbH. Its 14.4.1 release, published 21 October, says: "Please upgrade to this version as soon as possible as it ships the updated php dependencies." AIO 15.0.0, with Nextcloud 35.0.2, followed on 22 October. Any version from 14.4.1 onward has the fix.

Follow AIO's own update instructions, then confirm the AIO version you run is 14.4.1 or later. Nextcloud's AIO issue for PHP2Shell (#8876) was still open on 23 October as the place for further updates.

Docker: Pull, Recreate and Read PHP From the Image

The community image's own README says it "is maintained by community volunteers and designed for expert use." Its tags were rebuilt on 23 October 2026, and the same day its maintainers set session.upload_progress.enabled=0 inside the image, citing PHP's advice for CVE-2026-115560.

Updating means replacing containers, not just downloading images. With Docker Compose, for example:

docker compose pull
docker compose up -d

Docker's documentation says compose up "picks up the changes by stopping and recreating the containers (preserving mounted volumes)" when the image has changed. If you build your own image on top of Nextcloud's, rebuild it with docker compose build --pull first.

The Nextcloud tag doesn't tell you the PHP version. The image repository's Dockerfiles currently build Nextcloud 35 and 34 on php:8.5, 33 on php:8.4 and 32 on php:8.3. Read the version from the running container instead, for example docker compose exec app php -v (replace "app" with your service name).

Manual Installs: Patch PHP and Restart

1. Back up the database, the data directory and config.php. See our guide to website backup and recovery.
2. Install the fixed PHP packages. On Debian or Ubuntu with PHP-FPM, for example (replace 8.3 with your version):
   sudo apt update
   sudo apt upgrade
   sudo systemctl restart php8.3-fpm
   On RHEL-family systems, sudo dnf upgrade, then sudo systemctl restart php-fpm.
3. Restart Apache if it runs mod_php, which Nextcloud supports, for example sudo systemctl restart apache2. Restart any other long-running PHP process too. See how to restart PHP workers.
4. Confirm the build that serves the site, as described below.
5. Check for compromise from at least 17 October 2026. Our guide on checking whether your site was hacked through PHP2Shell lists what to look for.

Nextcloud's release and PHP table shows which PHP each version allows:

If a Nextcloud upgrade is part of the plan, do it after PHP is patched. Nextcloud's upgrade manual says: "You cannot skip major releases."

How to Confirm the PHP Version

Nextcloud's bundled Monitoring app adds a System section to the administration settings, which reports the PHP version the web server runs. On the command line, php -v works, but make sure it's the same PHP your web server uses.

The version number can mislead. The Monitoring app shows only the upstream number, and Linux distributions backport fixes without changing it. A patched Ubuntu 24.04 server still reports 8.3.6. Check your package version against your distribution's advisory, or ask your host for the build date. Our guide on how to check your PHP version covers each method.

Interim Settings and Uploads

If you can't patch today, PHP's advisory lists settings that reduce exposure but "do not make an installation safe." Set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker, and keep it off after patching, as the Docker image now does. Be careful with PHP's suggested low post_max_size: a file server is built for uploads, and Wiz's PHP2Shell guidance says the setting "constrains file uploads, so test legitimate upload flows." Every option and its side effects are in PHP2Shell interim mitigations.

Conclusion

As of 23 October 2026, Nextcloud is one of the applications researchers used to prove PHP2Shell works, and the fix sits in PHP. AIO users should be on 14.4.1 or later, Docker users should pull and recreate, and manual installs need patched PHP and a restart. Then check for compromise, because a file server holds data worth stealing. If you need a server patched quickly, see our emergency PHP patching service. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions