php Package Upgrade for ELS8 to fix PHP2Shelll

Netsweeper recommends all customers running EL8 to upgrade the following packages. This can be run on any Netsweeper EL8 release from 7.2 to 9.2.3. The 9.2.4 includes the following RPMs. This is an emergency update to resolve all vectors for CVE-2026-109618 and CVE-2026-109619. All customers are encourage to run this on ALL Netsweeper servers running EL8.

Upgrade

dnf upgrade -y \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-cli-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-common-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-embedded-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-fpm-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-gd-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-json-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-ldap-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-mbstring-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-mysqlnd-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-pdo-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-process-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-snmp-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-soap-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-xml-7.2.24-2.el8.x86_64.rpm \
https://repo.netsweeper.com/tickets/Ticket-NS3095-php2shell-el8/php-opcache-7.2.24-2.el8.x86_64.rpm

Restart PHP-FPM

systemctl try-restart php-fpm

You can confirm the fix is applied by running the following command:

php -d memory_limit=8M -r 'register_shutdown_function(function(){echo "shutdown-ran\n";}); $a=str_repeat("x", 64*1024*1024);'

If the fix is applied you WILL NOT get the message “shutdown-ran“. Getting the “shutdown-ran” indicates the issue has not yet been resolved.