Ubuntu PHP Fixes Need a Service Restart After the Package Update

Installing Ubuntu’s PHP security update is only part of closing the php2shell exposure. Canonical says applications using the interpreter will probably need restarting, even when unattended-upgrades has already delivered the patched packages. A successful overnight update does not establish that a running website has loaded the new code.

The Ubuntu Security Team’s October 21 advisory covers CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS 4.0 score of 9.2. Canonical describes unauthenticated remote code execution with the PHP application’s credentials when an attacker can reach the web application over the network.

Match the revision to your Ubuntu release

There is no single upstream version number that proves every Ubuntu machine is patched. Canonical maintains different PHP branches for different releases. These are its fixed package revisions for systems receiving standard support:

• Ubuntu 22.04 LTS: php8.1, version 8.1.2-1ubuntu2.28.
• Ubuntu 24.04 LTS: php8.3, version 8.3.6-0ubuntu0.24.04.13.
• Ubuntu 26.04 LTS: php8.5, version 8.5.4-0ubuntu1.5.
• Ubuntu 26.10: php8.5, version 8.5.9-0ubuntu2.1.

The revision after the upstream number is significant. Moving a production website to another PHP branch just to obtain a larger version number introduces a compatibility change that this security update does not require. Compare the installed package against the entry for the release you actually run.

Inventory, update, then deal with running applications

Canonical supplies this command to list installed interpreter packages:

apt list '?installed ?name(^php[0-9.]+$)'

Record the result before updating, then run the same check afterwards. Its recommended full-system update is:

sudo apt update
sudo apt upgrade

Review the proposed changes before confirming them. If a full upgrade cannot be arranged, the advisory also documents a targeted alternative:

sudo apt update
sudo apt install --only-upgrade '?name(^php[0-9.]+$)'

The next action depends on how the website runs PHP. Canonical specifically says Apache using mod_php requires an Apache restart:

sudo systemctl restart apache2

Do not treat that example as a universal PHP restart command. Establish which service runs the interpreter on your machine. A planned reboot is Canonical’s alternative for ensuring applications use updated components; schedule it with the interruption to hosted services in mind.

Automatic updates and older releases need separate checks

Ubuntu enables unattended-upgrades by default from 16.04 LTS onward. Canonical says it applies security updates every 24 hours when enabled, but explicitly retains the restart or reboot requirement. Check both the package result and the application’s operation after the maintenance.

Ubuntu 20.04 and 18.04 fixes require Expanded Security Maintenance. The 16.04 and 14.04 packages require ESM with the Legacy add-on. An ordinary update check on those machines does not prove that the required coverage is enabled.

Our Ubuntu curl update report explains another case where the distribution’s package revision matters. For PHP, add the running service to that checklist: inventory the right packages, install the matching fix, restart the relevant application and confirm the website works.