PHP2Shell Incident, What Should I Do

On 21 October 2026, the PHP security team released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS 9.2. These vulnerabilities could allow unauthenticated remote code execution on affected servers.

Since Passbolt's API runs on PHP, Passbolt Cloud was temporarily taken offline as a precaution while the patches were deployed. The service has since been restored, and patched versions are available for self-hosted installations.

Here's what Passbolt users need to know and what actions to take.

Self-Hosted Users

If you're running a self-hosted Passbolt instance, you should check your PHP version and update it if necessary.

1. Check your PHP version

Connect to your server and run:

php -v

This checks the command-line PHP version. Make sure to also verify the version used by your web server, as it may differ.

2. Check whether your PHP version is affected

| PHP Branch | Fixed Version |
|------------|---------------|
| 8.2        | 8.2.35        |
| 8.3        | 8.3.36        |
| 8.4        | 8.4.27        |
| 8.5        | 8.5.12        |

PHP 8.1 and older has reached end-of-life and will not receive official fixes.

3. Apply the security update

The update process depends on your installation method:

For Ubuntu, Debian and assets that are based on them (VM appliance,AWS AMI and Digital Ocean):

sudo apt-get update
sudo apt-get install --only-upgrade 'php*'
sudo systemctl restart php*-fpm

For RHEL based distributions:

sudo dnf clean metadata && sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

For OpenSUSE/SLES:

sudo zypper refresh && sudo zypper update 'php*'
sudo systemctl restart php-fpm

For docker, follow our Update Passbolt on Docker documentation.

For more information, refer to the CERT-EU's advisory and Passbolt incident report.

Cloud Users

No action is required for Passbolt Cloud Users.

On 21 October, Passbolt Cloud was temporarily taken offline from 14:30 to 17:25 CEST, following CERT-EU's recommendation to isolate internet-facing applications until security patches became available.

The incident is now resolved. A full timeline and further details are available in the incident report.

Conclusion

The PHP security patches are available, and Passbolt Cloud has been updated and restored.

Self-hosted users should keep your PHP version up to date with the latest official release.

For further questions or assistance, reach out through the Passbolt community forum.

A full timeline and further details are available in the incident report.

For additional guidance on hardening Passbolt installation, check out the blog You’re the Admin Now: A Security Check-Up.

Stay safe out there.