php Package Upgrade for EL8 to fix PHP2Shelll

Netsweeper recommends all customers running EL8 to upgrade the following packages. This can be run on any Netsweeper EL8 release from 7.2 to 9.2.3. The 9.2.4 includes the following RPMs. This is an emergency update to resolve all vectors for CVE-2026-109618 and CVE-2026-109619. All customers are encourage to run this on ALL Netsweeper servers running EL8.

This is the recommended solution for customers running EL8 deployments - there is no need to follow the steps in our previous workaround article.

However, customers running EL6 deployments must refer to the steps outlined for EL6-based deployments in our initial Security Advisement knowledgebase article.

Additionally, Netsweeper recommends all customers still running EL6 deployments begin to plan their upgrade to EL8 in order to ensure the have access to our latest features, bug fixes, security patches, and more.

Upgrade the Packages

dnf upgrade -y \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-cli-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-common-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-embedded-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-fpm-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-gd-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-json-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-ldap-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-mbstring-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-mysqlnd-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-pdo-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-process-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-snmp-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-soap-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-xml-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-opcache-7.2.24-2.el8.x86_64.rpm

Restart PHP-FPM

systemctl try-restart php-fpm

You can confirm the fix is applied by running the following command:

php -d memory_limit=8M -r 'register_shutdown_function(function(){echo "shutdown-ran\n";}); $a=str_repeat("x", 64*1024*1024);'

If the fix is applied you WILL NOT get the message “shutdown-ran“. Getting the “shutdown-ran” indicates the issue has not yet been resolved.

After Upgrading - Optionally Revert Prior Patches

If you already applied the prior patches to remove the memory limit and restrict upload sizes, (as outlined in our initial Security Advisement FAQ,) you can optionally remove this restrictions if the above update has been completed.

cd ~/
mkdir php2shell.back.revert
cp /etc/php-fpm.d/*.conf php2shell.back.revert/
perl -pi -e 's@^php_value\[memory_limit\][ \t]*=[ \t]*[-0-9]+[MG]*$@php_value[memory_limit] = 256M@' /etc/php-fpm.d/*.conf
perl -pi -e 's@^php_value\[post_max_size\][ \t]*=[ \t]*[0-9]+[MG]*$@php_value[post_max_size] = 201M@' /etc/php-fpm.d/*.conf
perl -pi -e 's@^php_value\[upload_max_filesize\][ \t]*=[ \t]*[0-9]+[MG]*$@php_value[upload_max_filesize] = 200M@' /etc/php-fpm.d/*.conf
perl -pi -e 'if (s/^php_value\[session.upload_progress.enabled\][ \t]*=.*/php_value[session.upload_progress.enabled] = Off/) { $found = 1; } if (eof && !$found) { $_ .= "\nphp_value[session.upload_progress.enabled] = Off\n"; }' /etc/php-fpm.d/ns_webadmin.pool.conf
systemctl try-restart php-fpm

If you have any questions about the above process, or have concerns please email technical support.