PHP2Shell Incident, What Should I Do

On 21 October 2026, the PHP security team released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS 9.2. These vulnerabilities could allow unauthenticated remote code execution on affected servers.

Since Passbolt's API runs on PHP, Passbolt Cloud was temporarily taken offline as a precaution while the patches were deployed. The service has since been restored, and patched versions are available for self-hosted installations.

Here's what Passbolt users need to know and what actions to take.

Self-Hosted Users

If you're running a self-hosted Passbolt instance, you should check your PHP version and update it if necessary.

1. Check your PHP version

Connect to your server and run:

php -v

This checks the command-line PHP version. Make sure to also verify the version used by your web server, as it may differ.

2. Check whether your PHP version is affected

| PHP Branch | Fixed Version |
|------------|---------------|
| 8.2        | 8.2.35        |
| 8.3        | 8.3.36        |
| 8.4        | 8.4.27        |
| 8.5        | 8.5.12        |

PHP 8.1 and older has reached end-of-life and will not receive official fixes.

3. Apply the security update

The update process depends on your installation method:

For Ubuntu, Debian and assets that are based on them (VM appliance,AWS AMI and Digital Ocean):

sudo apt-get update
sudo apt-get install --only-upgrade 'php*'
sudo systemctl restart php*-fpm

For RHEL based distributions:

sudo dnf clean metadata && sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

For OpenSUSE/SLES:

sudo zypper refresh && sudo zypper update 'php*'
sudo systemctl restart php-fpm

For docker, follow our Update Passbolt on Docker documentation.

For more information, refer to the CERT-EU's advisory and Passbolt incident report.

4. Consider following PHP recommendations: Session upload progress

We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.

The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.

Cloud Users

No action is required for Passbolt Cloud Users.

On 21 October, Passbolt Cloud was temporarily taken offline from 14:30 to 17:25 CEST, following CERT-EU's recommendation to isolate internet-facing applications until security patches became available.

The incident is now resolved. A full timeline and further details are available in the incident report.

Conclusion

The PHP security patches are available, and Passbolt Cloud has been updated and restored.

Self-hosted users should keep your PHP version up to date with the latest official release.

For further questions or assistance, reach out through the Passbolt community forum.

A full timeline and further details are available in the incident report.

For additional guidance on hardening Passbolt installation, check out the blog You’re the Admin Now: A Security Check-Up.

Stay safe out there.