---
title: 'Emergency PHP Patching Guide: How to Bypass Launchpad Timeouts and Secure Your Server Against CVE-2026-109618 & CVE-2026-109619'
url: 'https://docs.agenteum.top/blog/2026-10-22-emergency-php-patching-guide'
markdown: 'https://docs.agenteum.top/blog/2026-10-22-emergency-php-patching-guide.md'
date: '2026-10-22'
description: 'When critical RCE vulnerabilities like CVE-2026-109618 and CVE-2026-109619 hit, Launchpad throttles under the patch rush. Verify the packages.sury.org mirror, switch apt sources or force IPv4, patch, and restart the Apache + PHP-FPM stack cleanly.'
taxonomy:
  category:
    - tech
  tag:
    - php
    - security
    - cve
    - apache
    - php-fpm
    - apt
    - ubuntu
  archives_month:
    - oct_2026
  archives_year:
    - '2026'
---

When critical Remote Code Execution (RCE) vulnerabilities like **CVE-2026-109618** and **CVE-2026-109619** (*php2shell*) hit the wire, every system administrator rushes to patch their servers at the exact same time. If your Debian or Ubuntu server relies on Ondřej Surý’s repository (`ppa:ondrej/php`), this sudden global spike in traffic often causes Ubuntu’s Launchpad servers (`ppa.launchpadcontent.net`) to throttle connections, hang on IPv6 routing, or drop requests with `403 Forbidden` and `502 Bad Gateway` errors.

Instead of waiting for Launchpad to recover while your server remains exposed, you can verify whether your system supports Ondřej Surý’s high-speed CDN mirror (`packages.sury.org`), switch your `apt` sources, or force `apt` through a resilient IPv4 route.

This step-by-step guide walks you through diagnosing repository availability, applying the security patches, and safely restarting an **Apache + PHP-FPM** stack through a full system reboot.

---

## Step 1: Pre-Flight Availability Check (Without Touching Configs)

Before modifying any `/etc/apt/` files, test how the repository servers respond to your droplet or VPS.

### 1. Check if your OS release is hosted on `packages.sury.org`

Run the following `curl` command. The `$(lsb_release -sc)` subshell automatically injects your OS codename (such as `bookworm`, `bullseye`, `noble`, or `jammy`) into the URL without altering your system:

```bash
curl -ILs "https://packages.sury.org/php/dists/$(lsb_release -sc)/Release" | grep -E "^HTTP/"
```

**How to interpret the result:**

- **`HTTP/2 200`**: Your OS codename is directly supported by the `packages.sury.org` CDN (typical for Debian systems or supported derivatives). You can proceed directly to **Step 2 (Path A)** to migrate off the slow repo.
- **`HTTP/2 404` (or `403`)**: You are running a standard Ubuntu release (`jammy`, `noble`, `focal`) whose packages are hosted exclusively on Launchpad (`ppa:ondrej/php`). Do **not** switch to `packages.sury.org` or you will break package dependencies. Instead, check your IPv4 route below and use **Step 2 (Path B)**.

### 2. Diagnose Launchpad IPv4 vs. IPv6 timeouts (For Ubuntu PPA users)

Cloud instances (especially on DigitalOcean, AWS, and Hetzner) frequently hang when connecting to Canonical’s Launchpad servers over IPv6 during heavy load. Test a forced IPv4 connection:

```bash
curl -4 -Is --connect-timeout 5 "https://ppa.launchpadcontent.net/ondrej/php/ubuntu/dists/$(lsb_release -sc)/Release" | head -n 1
```

If this immediately returns `HTTP/1.1 200 OK` or `HTTP/2 200`, Launchpad is online, and your `apt` client was simply getting stuck on a dead IPv6 route.

---

## Step 2: Switching Repositories or Forcing the Update

Choose **Path A** if Step 1.1 returned `HTTP/2 200`, or **Path B** if your server relies on the Ubuntu Launchpad PPA.

### Path A: Switching to the `packages.sury.org` CDN

1. **Quarantine the old repository files.** Move any existing `ondrej` list files into `/root/` as a safe backup so `apt` stops trying to query the hanging server:

    ```bash
    sudo mv /etc/apt/sources.list.d/*ondrej* /root/ 2>/dev/null || true
    ```

    *Verification:* Run `grep -rn "launchpad" /etc/apt/sources.list*` — it should return no output for PHP repositories.
2. **Install the official Sury GPG signing key and register the CDN repository:**

    ```bash
    sudo apt-get install -y apt-transport-https lsb-release ca-certificates curl
    sudo curl -sSLo /usr/share/keyrings/deb.sury.org-php.gpg https://packages.sury.org/php/apt.gpg
    echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/sury-php.list
    ```

    *Verification:* Confirm the key exists and is non-empty with `ls -lh /usr/share/keyrings/deb.sury.org-php.gpg`.
3. **Refresh package lists and upgrade all installed PHP packages:**

    ```bash
    sudo apt-get update
    sudo apt-get --only-upgrade install "php*" -y
    ```

> **Rollback Note (Unmet Dependencies):** If `apt-get install` halts with `Unmet dependencies` regarding core libraries (`libc6` or `libssl3`), your OS environment requires the Ubuntu Launchpad build rather than the Debian CDN build. Roll back immediately with:
> 
> ```bash
> sudo rm -f /etc/apt/sources.list.d/sury-php.list
> sudo mv /root/*ondrej* /etc/apt/sources.list.d/ 2>/dev/null || true
> ```
> 
> Then immediately execute **Path B** below.

### Path B: Bypassing Launchpad Timeouts on Ubuntu (IPv4 + Retries)

If your server uses the Ubuntu PPA, you don’t need to rewrite your repository files. Force `apt` to bypass broken IPv6 routes and automatically retry dropped connections up to 5 times:

```bash
sudo apt-get -o Acquire::ForceIPv4=true -o Acquire::Retries=5 update
sudo apt-get -o Acquire::ForceIPv4=true -o Acquire::Retries=5 --only-upgrade install "php*" -y
```

---

## Step 3: Restarting the Apache + PHP-FPM Stack

Updating packages via `apt` only replaces binary files on the disk. The vulnerable PHP code continues running in your server’s RAM until the active processes are restarted.

In an **Apache + PHP-FPM** setup (where Apache communicates with PHP via `mod_proxy_fcgi` over a Unix socket or TCP port), you must restart **both** services in the proper sequence:

1. **Restart all running PHP-FPM pools first.** The command below automatically detects and restarts every active PHP-FPM version (`php8.1-fpm`, `php8.2-fpm`, `php8.3-fpm`, `php8.4-fpm`, etc.) on your machine:

    ```bash
    sudo systemctl list-units --type=service --state=running | grep -o 'php[0-9.]*-fpm\.service' | xargs -r sudo systemctl restart
    ```
2. **Restart Apache to flush worker connections to the FPM socket:**

    ```bash
    sudo systemctl restart apache2
    ```
3. **Restart background CLI workers (if applicable).** Long-running daemon processes like Laravel Horizon, Symfony Messenger, or Supervisor queues also hold the old PHP binary in memory:

    ```bash
    sudo supervisorctl restart all 2>/dev/null || true
    ```
4. **Verify service health:**

    ```bash
    sudo systemctl status apache2 "php*-fpm" --no-pager | grep -E "Loaded:|Active:"
    ```

    Ensure both `apache2` and your `php-fpm` service display `Active: active (running)`.

---

## Step 4: Verifying the Patch and Performing a Clean Server Reboot

Even after restarting PHP-FPM and Apache, system updates often pull in updated shared libraries (`libssl`, `libc`, `systemd`) or leave orphaned processes running old file descriptors in memory.

### 1. Verify the installed PHP version and build date

Run the CLI version check:

```bash
php -v
```

Confirm that your active PHP branch has updated to the patched release (**8.5.12**, **8.4.27**, **8.3.36**, or **8.2.35**) or displays a build timestamp (`Oct 2026`) with the `+deb.sury.org` or `+ubuntu` security suffix.

### 2. Check for processes still using outdated libraries or requires-reboot flags

On Debian and Ubuntu, you can check whether the kernel or core services require a full machine reboot:

```bash
if [ -f /var/run/reboot-required ]; then
    cat /var/run/reboot-required
    cat /var/run/reboot-required.pkgs 2>/dev/null
else
    echo "No mandatory kernel reboot flag, but a clean reboot ensures all memory is flushed."
fi
```

### 3. Enable services on boot and reboot the server

Before rebooting a production server, always ensure that both Apache and your PHP-FPM service are enabled in `systemd` so your websites come back online automatically when the machine boots:

```bash
# Automatically enable Apache and any currently running PHP-FPM service on boot
sudo systemctl enable apache2
sudo systemctl list-units --type=service --state=running | grep -o 'php[0-9.]*-fpm\.service' | xargs -r sudo systemctl enable

# Reboot the server
sudo reboot
```

### 4. Post-Reboot Final Check

Wait 30–60 seconds for your DigitalOcean droplet to come back online, log back in via SSH, and run a final sanity check:

```bash
uptime
sudo systemctl is-active apache2 "php*-fpm"
curl -Is http://localhost | head -n 1
```

Once `systemctl is-active` returns `active` and `curl` returns a valid HTTP response (`200 OK`, `301`, or `302`), your server is running entirely on fresh memory with the patched PHP binaries.

---

## Navigation

- Parent: [Blog](https://docs.agenteum.top/blog.md)
- Previous: [Running LLM Jobs in the Off-Peak Window: Our Night-Shift Cron Schedule](https://docs.agenteum.top/blog/2026-10-22-off-peak-llm-night-shift-cron.md)
- Next: [When hermes update times out: migrating a legacy source install to the blobless era](https://docs.agenteum.top/blog/2026-10-21-hermes-update-timeouts-legacy-source-install.md)