Ubuntu Rolls Out php2shell Security Fixes and eMudhra Certificate Updates

Ubuntu has issued security updates addressing two serious issues: the php2shell vulnerabilities in PHP and a compromise involving certificate authority eMudhra.

The php2shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let an attacker with network access run code through a vulnerable PHP application without logging in. PHP powers roughly 70% of websites, making the vulnerabilities potentially far-reaching. They have a critical CVSS 4.0 rating of 9.2, and Cloudflare has reported seeing attack traffic.

The eMudhra compromise could allow attackers to create fraudulent website certificates and impersonate legitimate servers. Ubuntu’s update to ca-certificates removes two root certificates that had vouched for eMudhra. This helps protect tools such as curl and wget, which rely on the system’s trusted certificate list. Major browser vendors had already blocked the affected certificates.

Desktop Ubuntu systems are not directly exposed to php2shell because PHP is not installed by default. However, the certificate update applies more broadly. Check for updates using Software Updater, or run:

sudo apt update && sudo apt upgrade

If you manage an Ubuntu server or another system that may use PHP, install the updates promptly. Supported Ubuntu releases from 14.04 LTS through 26.10 receive the fixes, though Ubuntu 14.04, 16.04 and 18.04 require Ubuntu Pro. On servers where a full system upgrade or reboot is not practical, PHP can be updated separately; Canonical recommends restarting services that use PHP if the system is not rebooted.