Full write-up, fix commands and NGINX-side mitigations: https://www.getpagespeed.com/php2shell

php.net fixed PHP2Shell (CVE-2026-109618 / CVE-2026-109619) only in 8.2 and newer, and Remi stopped building for CentOS 7 in June 2024, so every Remi EL7 PHP is going to stay vulnerable.

We rebuilt all of them with the fix: 5.6, 7.0 to 7.4, 8.0 and 8.1 got backports, and 8.2 to 8.4 are the fixed upstream releases. Package names are the same as Remi's, so it's an in-place upgrade, and PECL extensions and ionCube keep working:

yum -y install https://extras.getpagespeed.com/release-latest.rpm yum --enablerepo=getpagespeed-extras-php74 upgrade 'php-*' systemctl restart php-fpm

(Replace php74 with your version. For software collections, run yum upgrade 'php74-php*' instead.)

php -v still says 7.4.33 afterwards, so version-based scanners will keep flagging you. This script checks the actual package release: https://github.com/GetPageSpeed/php2shell-check

Disclosure: I run GetPageSpeed. The packages are free.