[IMPORTANT] - PHP Security Issue

[Alex-developer]

⚠️ PHP2Shell security alert: action needed for ALL Allsky users

Caution

Two critical vulnerabilities in PHP, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed on 21 October 2026. Allsky's WebUI and the Allsky Website both run on PHP, so both are affected.

Why this matters

An attacker can take full control of a vulnerable machine by sending it a single web request. They don't need to log in, and your Allsky WebUI password won't stop it. People are already trying to exploit it on the internet.

Who needs to act?

Everyone should update.

Your setup	Urgency
Your Pi can be reached from the internet (port forwarding, DMZ, public website on the Pi)	🔴 Act now
You upload to an Allsky Website on a hosted server or VPS	🔴 Act now (see Part 2)
Your Pi is only on your home network	🟠 Update soon. The risk is lower but not zero: another infected device on your network could attack it, and plenty of people have ports open without realising.

---

Part 1: Your Allsky Pi

Step 1: Find out which version of Pi OS you have

cat /etc/os-release | grep VERSION_CODENAME

Step 2: What to do for your version

Pi OS version	Fix available?	Fixed PHP package version
Trixie (Debian 13)	✅ Yes	8.4.27-1~deb13u1 or later
Bookworm (Debian 12)	✅ Yes	8.2.35-1~deb12u1 or later
Bullseye (Debian 11)	❌ No: end of life	n/a
Buster or older	❌ No: end of life	n/a

✅ Trixie or Bookworm

Run:

sudo apt update && sudo apt upgrade -y
sudo reboot

Important

Don't skip the reboot. PHP that's already running keeps using the old, vulnerable code until it's restarted. Rebooting is the simplest way to make sure the fix is actually in use.

❌ Bullseye, Buster or older

Bullseye stopped getting security updates on 31 August 2026, and its PHP 7.4 won't be patched. Buster and older have been unsupported for even longer.

• Reachable from the internet: disconnect it from the internet now (see below), then move to Bookworm or Trixie. That means a fresh OS install and then reinstalling Allsky.
• Home network only: less urgent. But you won't get any more security fixes on this version, so please plan to move to Bookworm or Trixie soon.

Step 3: Check the update worked

dpkg -l | grep -E "php8\.[24]-(cgi|fpm|common)"

The version shown should be the same as, or newer than, the fixed version in the table above.

Note

Don't rely on php -v. Debian fixes security problems without always changing the main version number, so php -v may still show an older-looking version even when the fix is installed.

Tip

On 32-bit Pi OS? The 32-bit packages are rebuilt separately and can arrive a little later than 64-bit. If the fixed version isn't showing yet, try again over the next day or so, and keep the Pi off the internet until it does.

Can't update yet? Disconnect it from the internet

Turn off any port forwarding or DMZ rule for the Pi on your router. The UK's NCSC is advising the same: take systems offline if you can't patch them.

---

Part 2: Allsky Website on a hosted server or VPS

If your Pi uploads to an Allsky Website on another server, that server runs PHP too and needs fixing. Those servers are on the internet by design, so treat this as urgent.

What you do depends on the type of hosting.

🌐 Shared or managed hosting

(cPanel, Plesk or similar, where the hosting company runs the server)

• Your hosting company is responsible for patching PHP. Check their status page or contact support to confirm they've applied the PHP2Shell fixes.

• If your control panel lets you choose a PHP version, pick a supported one: 8.2, 8.3, 8.4 or 8.5. Patched versions from the PHP project are:

  PHP branch	Patched version
  8.5	8.5.12 or later
  8.4	8.4.27 or later
  8.3	8.3.36 or later
  8.2	8.2.35 or later

  Hosts that build their own PHP may use different version numbers, so if in doubt, ask them.

• Avoid PHP 8.1 or older where you can. Those versions no longer get regular security fixes from the PHP project.

🖥️ VPS or your own server

(you have root/SSH access, so updating it is your responsibility)

1. Install updates.
   • Debian or Ubuntu:

     sudo apt update && sudo apt upgrade -y
     sudo reboot

     If you can't reboot, at least restart PHP-FPM and your web server.
   • Other Linux distributions: use their normal update tool (dnf, yum etc.).
2. Check the fix has arrived.
   • Debian: fixed for Bookworm and Trixie (same versions as in Part 1).
   • Ubuntu and others: check your distribution's security notices for CVE-2026-109618 and CVE-2026-109619. At the time of writing, no Ubuntu notice had been published. If there's no fix yet, take the site offline (see below).
3. Installed PHP from a third-party repository? (e.g. Ondřej Surý's PPA, or Remi's repo) Check that it has published updates. Reports say Remi's repo hadn't been updated at the time of disclosure.
4. Is the server's OS end of life? (e.g. Debian 11, Ubuntu 20.04 without paid support, CentOS 7) If so, it won't get a fix. Move the website to a supported OS.

Can't patch the website server yet?

Take the site offline until you can. Either suspend it in your hosting panel, or stop the web server:

sudo systemctl stop apache2   # if you use Apache
sudo systemctl stop nginx     # if you use nginx

Your Pi will report upload errors until the site is back, but your images are still saved on the Pi.

Warning

Is the website server used for anything else? If the same server hosts other sites or data, a compromise of any PHP site on it can affect everything. Patch it all.

---

Longer term

• Think about whether the Pi's WebUI needs to be public at all. If you just want to share your images, uploading to a separate website is much safer than exposing the Pi directly. If you need to reach the WebUI from outside your home, use a VPN such as Tailscale or WireGuard rather than opening ports.
• Keep your website server updated with regular security updates. On Debian/Ubuntu, the unattended-upgrades package can install them automatically.

Think you may have been compromised?

If your Pi or website server has been reachable from the internet since mid-October, look for:

• Unfamiliar files, especially new .php files in your website folders
• Unexpected running processes or scheduled tasks (crontab -l, sudo crontab -l)
• Settings you didn't change

If you're unsure, the safest option is a clean install, then restoring your settings and images. Also change any passwords or keys the Pi uses to upload to your website.

---

Questions?

Ask below and we'll help where we can. Please tell us your Pi OS version and, for website servers, what kind of hosting you use.

References

• Debian security tracker: CVE-2026-109618
• Debian security tracker: CVE-2026-109619
• Debian 11 LTS end-of-life announcement
• Help Net Security: PHP2Shell vulnerabilities patched
• watchTowr: PHP2Shell FAQ

Last updated: 23 October 2026. We'll update this post as more fixes are released.