php2shell
Menu

Fix PHP2Shell on Rocky Linux

Rocky Linux builds its own PHP packages. A fixed package can keep an older version number with the patch added, so look for the package version below rather than for 8.4.27.

Release by release

ReleaseStatusFixed packageAdvisory
8, 9, 10No fix yetNo Rocky Linux advisory for these CVEs found as of 21 Oct 2026. RLSA IDs not verified.––

Confirm the fix is installed

rpm -q --changelog php-fpm | grep -m1 -E 'CVE-2026-10961[89]'

Restart PHP

Installing the package replaces the files on disk. PHP processes that are already running keep the old code.

sudo systemctl restart php-fpm && sudo systemctl restart httpd

If your release has no fix yet

Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.