Upgrading PHP on Trellis servers for the Oct 21 security release (PHP2Shell)

trellis
1

PHP is shipping a security release tomorrow, Wednesday, October 21 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS 9.2 (announcement). The affected and fixed versions will be published with the release.

Re-provisioning alone won’t upgrade PHP. Trellis installs PHP from Ondřej Surý’s PPA with apt_package_state: present, which installs packages but never upgrades them. Ubuntu’s unattended-upgrades doesn’t cover PPAs by default, so your servers won’t pick up the patch on their own.

Wait for the PPA build

The PPA builds from the official release, so expect a delay. Over the last five PHP 8.4 releases, the build was published anywhere from under an hour to about a day and a half after php.net’s announcement. Follow the tracking issue on Codeberg, check the PPA package list, or run this on your server:

sudo apt-get update && apt-cache policy php8.4-fpm

Once the “Candidate” version is newer than “Installed,” you’re ready.

Upgrade

trellis provision --extra-vars apt_package_state=latest --tags php production

This runs only the PHP role and upgrades PHP and its extensions to the latest versions in the PPA. Then restart PHP-FPM and confirm the version:

sudo service php8.4-fpm restart && php -v

Swap 8.4 for your php_version if you’re on something else. Repeat for staging and development.

More info

The vulnerabilities have been reported as CVE-2026-109618 and CVE-2026-109619, and some security researchers describe them as remote code execution bugs. PHP hasn’t published details yet. We’ll update this post with the official advisories once the release is out.

2

At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available

4

A possible stopgap is going around: turning off session.upload_progress.enabled. To be clear, this hasn’t come from PHP. It’s from posts reacting to the leak, and nothing official ties these vulnerabilities to session upload progress. WordPress doesn’t use this feature, though, so turning it off until you can upgrade is low-risk.

Trellis doesn’t have a variable for this setting, so add it to the PHP-FPM php.ini template at roles/php/templates/php-fpm.ini.j2, under the other session.* lines:

session.upload_progress.enabled = Off

Then provision:

trellis provision --tags php production

Trellis doesn’t reload PHP-FPM when php.ini changes, so on the server, as your admin user, reload it and confirm the setting:

sudo service php8.4-fpm reload
php-fpm8.4 -i | grep upload_progress.enabled

It should show Off. Remove the line once you’ve upgraded PHP.

If you’re behind Cloudflare and your plan supports request body fields in custom rules, you can also block requests that include the upload progress field:

any(http.request.body.form.names[*] == "PHP_SESSION_UPLOAD_PROGRESS") or http.request.body.raw contains "PHP_SESSION_UPLOAD_PROGRESS"
5

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out, and PHP has published the official advisory confirming CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp).

We’ve also released Trellis v1.32.1, which switches PHP from the ppa:ondrej/php Launchpad PPA to packages.sury.org (#1680, #1696). Ondřej Surý maintains both, but packages.sury.org is the one he now recommends, and today it had the patched builds before the PPA. Skip v1.32.0: it left the old PPA configured on existing servers, which could make provisioning hang while the PPA was overloaded.

Updating just the PHP repository

If you don’t want to upgrade all of Trellis right now, you can apply only these two changes. From your project root (the directory that contains trellis/):

curl -sL https://github.com/roots/trellis/commit/30c6a10e27ffa7b9e996e89bb1bda9b2bd48d128.diff | git apply --directory=trellis
curl -sL https://github.com/roots/trellis/commit/5881bdf94a986378b0f05485643cc6917d810f34.diff | git apply --directory=trellis

If your trellis/ directory is its own git repo, run them from inside trellis/ without --directory=trellis. If the patches don’t apply cleanly, replace the “Add PHP PPA” task at the top of roles/php/tasks/main.yml with the tasks from the current version of that file.

Upgrading PHP

Provision with the new repository and upgrade PHP in one step:

trellis provision --extra-vars apt_package_state=latest --tags php production

Then on the server, as your admin user:

sudo service php8.4-fpm restart && php -v

Swap 8.4 for your php_version. You should see 8.4.27 (or 8.3.36, 8.5.12, 8.2.35). Repeat for staging and development.

If you added the session.upload_progress.enabled = Off workaround from earlier in this thread, you can remove it once you’ve upgraded.