So you still run PHP 8.1 in your Debian distribution, i.e., Trixie, Bookworm, Bullseye ...er, or even older, because your PHP application has not been completely upgraded -- for whatever reason -- here is a procedure for you to patch your Debian PHP 8.1 against the artificial intelligence (AI) -aided discovered remote-code-execution (RCE) PHP2Shell. Hopefully it will provide you a little more time and/or actionable insight so as not to take your PHP application offline just yet.

Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.

Security advisory: Critical remote code execution vulnerabilities, update now

Thus, you may build your PHP 8.1 from the above official source or, since Debian does no provide long term support (LTS) for its PHP 8.1 release, we may do the next best thing: obtain the patch from a Debian derivative. And in fact, that is what this post is all about; borrowing the patch from Ubuntu Jammy and modify it accordingly for our Debian distribution.

Let's install PHP 8.1 build dependencies; wielding root or super user privilege:

Shell

NOTE: Attached metztli-GCC14-debian-packaging-for-php-8.1.34-enhanced-with-XMLRPC-address-CVE-2026-109618-109619-ome.patch is designed to be used with the Debian Packaging for PHP 8.1.34-6 referenced immediately below:

Shell

Notwithstanding, Debian Packaging for PHP 8.1.34-9 is in the queue and will not require the patch attached at the end of this post. But for now, if you were to attempt to clone PHP 8.1.34-9 you would get an error:

Shell

Cloning into 'php'...
warning: Could not find remote branch debian/8.1.34-9 to clone.
fatal: Remote branch debian/8.1.34-9 not found in upstream origin

Accordingly, we assume command two(2) above prior to testing (with the --dry-run flag option) the application of our referenced patch:

Shell

Now we remove --dry-run flag option to patch for real our Debian Packaging for PHP 8.1.34-6:

Shell

We examine the outcome of our applied patch:

Shell

And proceed to debianize our PHP 8.1.34 source with the enhanced patches under the debian/patches directory:

Shell

Prior to our build, we proceed to modify our debian/changelog so as to reflect the fact that our build addresses and/or mitigates the PHP Core RCE (CVE-2026-109618, CVE-2026-109619) critical vulnerability, for instance:

Shell

We start the PHP 8.1 build:

Shell

After approximately half-an-hour, assigning eight(8) threads/cores -- as evidenced by the -j8 flag to our dpkg-buildpackage Debian utility, our PHP 8.1 build hack completes:

Shell

---

AI-Assisted Research Uncovers Critical PHP2Shell RCE Vulnerabilities

DISCLAIMER:P although due diligence has been applied, this resource is made available for testing/evaluation purposes on an AS IS basis. The procedure only reflects my own modifications, my limited testing, and the potential user(s) who execute(s) the procedures assumes all risks.

Please do not hold me or Metztli Information Technology (and/or its associates) responsible if the information provided here does not achieve the desired result. The information is provided AS IS and with the hope that it may be useful to the Internet community --especially those in a predicament due to the critical software vulnerability.

Notwithstanding, There is no implicit or explicit guarantee that the information presented here is accurate --even though due diligence was exercised during the procedure. Accordingly, if an user(s) decide to use the software and/or implement the procedure or shell commands described here she, he, or them, do so at her, his, or their own risk. You have been forewarned.

Metztli IT, but not other entities, reserves the right to modify the content -- to correct and/or elucidated procedure(s), for instance -- and/or even delete all or partial, including blog post, without previous notice.