# Upgrading PHP on Trellis servers for the Oct 21 security release (PHP2Shell) **URL:** https://discourse.roots.io/t/upgrading-php-on-trellis-servers-for-the-oct-21-security-release-php2shell/30439 **Category:** trellis **Created:** 2026-10-20T21:08:20Z **Posts:** 11 ## Post 1 by @ben — 2026-10-20T21:08:20Z PHP is shipping a security release tomorrow, **Wednesday, October 21 at 14:00 UTC**. It fixes two critical vulnerabilities, both rated CVSS 9.2 ([announcement](https://www.php.net/archive/2026.php#2026-10-20-1)). The affected and fixed versions will be published with the release. **Re-provisioning alone won’t upgrade PHP.** Trellis installs PHP from [Ondřej Surý’s PPA](https://launchpad.net/~ondrej/+archive/ubuntu/php) with `apt_package_state: present`, which installs packages but never upgrades them. Ubuntu’s unattended-upgrades doesn’t cover PPAs by default, so your servers won’t pick up the patch on their own. ### Wait for the PPA build The PPA builds from the official release, so expect a delay. Over the last five PHP 8.4 releases, the build was published anywhere from under an hour to about a day and a half after [php.net](http://php.net)’s announcement. Follow the [tracking issue on Codeberg](https://codeberg.org/oerdnj/deb.sury.org/issues/145), check the [PPA package list](https://launchpad.net/~ondrej/+archive/ubuntu/php/+packages), or run this on your server: ``` sudo apt-get update && apt-cache policy php8.4-fpm ``` Once the “Candidate” version is newer than “Installed,” you’re ready. ### Upgrade ``` trellis provision --extra-vars apt_package_state=latest --tags php production ``` This runs only the PHP role and upgrades PHP and its extensions to the latest versions in the PPA. Then restart PHP-FPM and confirm the version: ``` sudo service php8.4-fpm restart && php -v ``` Swap `8.4` for your `php_version` if you’re on something else. Repeat for staging and development. ### More info The vulnerabilities have been [reported as CVE-2026-109618 and CVE-2026-109619](https://www.cyberkendra.com/2026/10/php-cve-2026-109618-cve-2026-109619-rce.html), and some security researchers describe them as remote code execution bugs. PHP hasn’t published details yet. We’ll update this post with the official advisories once the release is out. --- ## Post 2 by @ben — 2026-10-20T23:07:22Z > **[Critical Vulnerabilities in PHP](https://cert.europa.eu/publications/security-advisories/2026-018/)** > > Critical Vulnerabilities in PHP > At this time, no technical details have been made public. CERT-EU advises organisations to prepare for **immediate patching of affected assets**. Where immediate patching is not feasible, organisations should **consider isolating internet-facing applications from public networks until a fix is available** --- ## Post 3 by @ben — 2026-10-20T23:39:47Z --- ## Post 4 by @ben — 2026-10-21T01:26:03Z A possible stopgap is going around: turning off `session.upload_progress.enabled`. To be clear, this hasn’t come from PHP. It’s from posts reacting to the leak, and nothing official ties these vulnerabilities to session upload progress. WordPress doesn’t use this feature, though, so turning it off until you can upgrade is low-risk. Trellis doesn’t have a variable for this setting, so add it to the PHP-FPM php.ini template at `roles/php/templates/php-fpm.ini.j2`, under the other `session.*` lines: ``` session.upload_progress.enabled = Off ``` Then provision: ``` trellis provision --tags php production ``` Trellis doesn’t reload PHP-FPM when php.ini changes, so on the server, as your admin user, reload it and confirm the setting: ``` sudo service php8.4-fpm reload php-fpm8.4 -i | grep upload_progress.enabled ``` It should show `Off`. Remove the line once you’ve upgraded PHP. If you’re behind Cloudflare and your plan supports request body fields in custom rules, you can also block requests that include the upload progress field: ``` any(http.request.body.form.names[*] == "PHP_SESSION_UPLOAD_PROGRESS") or http.request.body.raw contains "PHP_SESSION_UPLOAD_PROGRESS" ``` --- ## Post 5 by @ben — 2026-10-21T16:08:12Z PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out, and PHP has published the [official advisory](https://www.php.net/archive/2026.php#2026-10-21-5) confirming CVE-2026-109618 ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)) and CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)). Since then, we’ve shipped three Trellis releases. Update to the latest, [v1.32.2](https://github.com/roots/trellis/releases/tag/v1.32.2): - [v1.32.0](https://github.com/roots/trellis/releases/tag/v1.32.0) switches PHP from the `ppa:ondrej/php` Launchpad PPA to [packages.sury.org](https://packages.sury.org/php/) ([#1680](https://github.com/roots/trellis/pull/1680)). Ondřej Surý maintains both, but [packages.sury.org](http://packages.sury.org) is the one he now recommends, and on release day it had the patched builds before the PPA. - [v1.32.1](https://github.com/roots/trellis/releases/tag/v1.32.1) removes the old PPA on existing servers ([#1696](https://github.com/roots/trellis/pull/1696)). v1.32.0 left it configured, which could make provisioning hang while the PPA was overloaded. - [v1.32.2](https://github.com/roots/trellis/releases/tag/v1.32.2) disables `session.upload_progress.enabled` by default ([#1697](https://github.com/roots/trellis/pull/1697)). [PHP now recommends keeping it off](https://x.com/thephpf/status/2113580383875019242) until the next PHP release to block another vector (CVE-2026-115560). WordPress doesn’t use it. ### Updating just the PHP role If you don’t want to upgrade all of Trellis right now, you can apply only these three changes. From your project root (the directory that contains `trellis/`): ``` curl -sL https://github.com/roots/trellis/commit/30c6a10e27ffa7b9e996e89bb1bda9b2bd48d128.diff | git apply --directory=trellis curl -sL https://github.com/roots/trellis/commit/5881bdf94a986378b0f05485643cc6917d810f34.diff | git apply --directory=trellis curl -sL https://github.com/roots/trellis/commit/3f37e7f1c5e9f0de8c99e2b16f3a584f37ea517d.diff | git apply --directory=trellis ``` If you already applied the first two, run only the third. If your `trellis/` directory is its own git repo, run them from inside `trellis/` without `--directory=trellis`. If the patches don’t apply cleanly, copy the changes from the [#1680](https://github.com/roots/trellis/pull/1680/files), [#1696](https://github.com/roots/trellis/pull/1696/files), and [#1697](https://github.com/roots/trellis/pull/1697/files) diffs by hand. ### Upgrading PHP Provision with the new repository and upgrade PHP in one step: ``` trellis provision --extra-vars apt_package_state=latest --tags php production ``` Then on the server, as your admin user: ``` sudo service php8.4-fpm restart && php -v ``` Swap `8.4` for your `php_version`. You should see 8.4.27 (or 8.3.36, 8.5.12, 8.2.35). Repeat for staging and development. If you already upgraded PHP, run `trellis provision --tags php production` to pick up the upload progress change. PHP-FPM reloads automatically. If you added the `session.upload_progress.enabled = Off` workaround from earlier in this thread by editing `php-fpm.ini.j2`, keep it or swap it for the new default from #1697, but don’t remove it on its own. --- ## Post 6 by @knilob — 2026-10-23T08:19:44Z I’m somehow stuck pulling the previous versions of PHP (8.4.26 or 8.3.35) when I try the `trellis provision --extra-vars apt_package_state=latest --tags php production` command. I’m also getting those versions if I try to set up a fresh instance of Trellis locally with 1.32.1. I’m not sure how I can force Trellis to pull the updated PHP versions at this point. --- ## Post 7 by @Tetrahedrax — 2026-10-23T08:42:47Z I had a similar problem. I ended up doing: > sudo apt update && sudo apt install --only-upgrade ‘php8.3\*’ And it installed the proper update for 8.3. --- ## Post 8 by @knilob — 2026-10-23T08:56:06Z Thanks for that tip, but it’s saying everything PHP-related is “already the newest version”. --- ## Post 9 by @Tetrahedrax — 2026-10-23T09:23:35Z Hmm.. Which version of Ubuntu are you on? Do you have the same problem if you try to update your local Trellis environment? Which PPA are you downloading it from? --- ## Post 10 by @ben — 2026-10-23T13:48:20Z :information_source: I’ve updated the [solution](https://discourse.roots.io/t/upgrading-php-on-trellis-servers-for-the-oct-21-security-release/30439/5) for [Trellis v1.32.2](https://github.com/roots/trellis/releases/tag/v1.32.2), which disables PHP session upload progress by default. PHP now [recommends keeping it off](https://x.com/thephpf/status/2113580383875019242) until the next PHP release to block another vector (CVE-2026-115560). If you’ve already upgraded PHP, update Trellis, or apply just this change from your project root: ``` curl -sL https://github.com/roots/trellis/commit/3f37e7f1c5e9f0de8c99e2b16f3a584f37ea517d.diff | git apply --directory=trellis ``` Then provision: ``` trellis provision --tags php production ``` PHP-FPM reloads automatically. --- ## Post 11 by @knilob — 2026-10-23T15:14:00Z > [@Tetrahedrax](#): > > Which version of Ubuntu are you on? I’m testing on a completely fresh setup of Trellis, so it’s whatever gets pulled by default now which is 24.0.4 I think.