Upgrading PHP to PHP 8.2 to Fix CVE-2026-109618 & CVE-2026-109619

In our previous overview, we explored the critical nature of the "php2shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Because these core engine flaws allow unauthenticated remote code execution, patching your server is not a background maintenance task—it is an immediate security necessity.

If you are running an Ubuntu-based server with Nginx or Apache using PHP-FPM, here is a step-by-step operational guide to upgrading your environment to a safe version (PHP 8.2.35 or higher), along with tips on managing code deprecations.

Step-by-Step Upgrade Guide for Ubuntu (Nginx & Apache with PHP-FPM)

1. Gain Root Access & Stop Services

Log into your server via SSH with administrative privileges (sudo). Before modifying packages or swapping PHP binaries, stop your web server to ensure clean state transitions during the update.

# If running Nginx  
sudo systemctl stop nginx

# If running Apache  
sudo systemctl stop apache2

(If you are on a managed control panel like cPanel or Plesk, you can manage service states directly through your service manager interface.)

2. Add the Upstream PHP Repository

Standard Ubuntu repositories often lag behind minor patch releases. To pull the official, security-patched minor releases (including PHP 8.2.35), add the trusted Ondřej Surý PPA repository:

sudo apt update  
sudo apt install \-y software-properties-common ca-certificates lsb-release apt-transport-https  
sudo add-apt-repository ppa:ondrej/php \-y  
sudo apt update

3. Install PHP 8.2 and Essential Modules

Install the core PHP 8.2 engine, PHP-FPM, and the critical modules required by modern content management systems (such as WordPress or Drupal):

sudo apt install \-y \\  
  php8.2 \\  
  php8.2-fpm \\  
  php8.2-cli \\  
  php8.2-mysql \\  
  php8.2-curl \\  
  php8.2-gd \\  
  php8.2-mbstring \\  
  php8.2-xml \\  
  php8.2-zip \\  
  php8.2-intl \\  
  php8.2-opcache

4. Update Your Virtual Host Configurations

If you are moving sites from an older PHP version to PHP 8.2, you need to point your virtual hosts to the new PHP-FPM socket.

For Nginx (/etc/nginx/sites-available/):
Open your site configurations and update the fastcgi socket pass:

• Nginx

location \~ \\.php\$ {  
    include fastcgi\_params;  
    fastcgi\_pass unix:/run/php/php8.2-fpm.sock;  
    fastcgi\_param SCRIPT\_FILENAME $documen{t}_{r}oot$fastcgi\_script\_name;  
}

For Apache (/etc/apache2/sites-available/):
Ensure your proxy-FPM handlers or SetHandler directives point to the PHP 8.2 FPM socket.

For cPanel Users:

Navigate to MultiPHP Manager, select your domains, change the PHP version dropdown to PHP 8.2, and click apply.

5. Restart Web Server & PHP-FPM Services

Bring your services back online with the updated configurations:

# Start and enable PHP 8.2 FPM  
sudo systemctl start php8.2-fpm  
sudo systemctl enable php8.2-fpm

# Test and reload Nginx / Apache  
sudo nginx \-t && sudo systemctl reload nginx  
# or for Apache: sudo apache2ctl configtest && sudo systemctl restart apache2

Troubleshooting & Debugging Deprecated Code

Upgrading from older stacks (like PHP 7.x or early PHP 8.0) to PHP 8.2 can sometimes expose legacy code issues. If a site throws a white screen or a fatal error post-upgrade, use your logs to diagnose the root cause:

• Check Logs: Inspect your Nginx/Apache error logs (/var/log/nginx/error.log) or your site-specific error files.

Need Professional Guidance?

Securing your infrastructure, managing server migrations, and refactoring legacy code shouldn't take you away from running your business. Let us handle the technical heavy lifting while you focus on your vision.

Get in Touch for Expert IT Support & Server Patching Solutions