Ubuntu ships fixes for php2shell and eMudhra certificate compromise
Canonical has released critical Ubuntu updates for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) and the compromised eMudhra certificate key. Patches cover supported releases from 14.04 LTS through 26.10, with 14.04–18.04 requiring Ubuntu Pro.
- PHP2Shell lets attackers run code in any PHP app without logging in, CVSS 9.2
- Fixes cover Ubuntu 14.04 LTS–26.04 LTS and 26.10; 14.04–18.04 need Ubuntu Pro
- eMudhra key revocation blocks forged website certificates
- PHP services must be restarted manually after the update
Read next
Security