Ubuntu has released security updates for the php2shell PHP flaw that’s led to websites being taken offline, and a key compromise at the eMudhra certificate authority.

Desktop Ubuntu isn’t directly affected by php2shell, since PHP isn’t installed by default. The certificate issue is more of a browser-based concern, though Google, Apple, Mozilla et al blocked the bad certificates on 17 October.

Ubuntu’s ca-certificates package update removes two root certificates from the list Ubuntu trusts, both of whom had vouched for eMudhra. This will help protect tools like curl and wget that don’t use their own lists.

Open Software Updater to check for any updates available on your setup1, and install them

You may have already heard about the security vulnerabilities since both have received mainstream media coverage over the past few days, php2shell in particular.

php2shell is the name given to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which affect the PHP interpreter. A bug could enable an attacker with network access to run code through any PHP application without logging in.

PHP is used by around 70% of websites, including WordPress-based ones like this one, so the scale of the exploit is potentially huge. Many legacy websites tick over year-on-year with minimal maintenance, running on outdated versions of PHP…

On the CVSS 4.0 severity scale, php2shell score 9.2 – critical. Cloudflare has already seen attack traffic aimed at the bugs, but it hasn’t said whether any succeeded.

The eMudhra security key compromise, if exploited, would allow attackers to create fake security certificates for websites and impersonate legitimate servers.

Just update, innit

If you run Ubuntu on a server, cloud or somewhere else you think PHP may be involved, it’s best to make the effort the go and update (or check your host provider for details on when they will) to be sure.

All Ubuntu versions with php5 or newer are affected2, but only Ubuntu versions still supported by Canonical (14.04 LTS through 26.04 LTS, and 26.103) will receive the fix – which can be applied along any other updates:

sudo apt update && sudo apt upgrade

On servers, upgrading everything isn’t always viable, so the package can be upgraded singularly. Canonical say any app or service that uses the PHP interpreter should be also be restarted manually if a full system reboot isn’t possible.

Say safe!

  1. If PHP isn’t installed, you won’t get the PHP fix – you don’t need it – but ca-certificates is preinstalled ↩︎
  2. While PHP only supports v8.1 and newer, Canonical backports critical fixes for supported Ubuntu releases, so as far php5 on Ubuntu 14.04 LTS is patched. ↩︎
  3. Ubuntu 14.04, 16.04 and 18.04 LTS only get the update if Ubuntu Pro is enabled. ↩︎