Raspberry Pi PHP Patch

Raspberry Pi devices running PHP are affected by the recent critical PHP2Shell RCE vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619), This includes the RPi radio web interface as it uses Apache server and mod-php. The actual Web software used to access the radio via a Web Browser is O!MPD written by Artur Sierzant and runs on top of the Apache Web Server. Unless there is access from the outside world to the RPi web server then the risk is minimal. To have access someone would have to have configured their IP router to allow access on port 80 to the RPi webserver or they must already be on the private network used by the radio. Even if this was the case what data is at risk? In the case of the radio this would only be your playlists. However, If a hacker did get access to the server, they could presumably launch attacks on other systems in the private network. So the patch should be applied.

You must update your PHP runtime to PHP version 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately to stay secure.
Most Trixie systems are running PHP 8.4.26 which must be upgraded to version 8.4.27.
Note: This patch has only been tested on a Raspberry Pi running Debian 13 (Trixie) so use with caution if applying to other systems

Check PHP version

Log into the Rasberry pi and run (don't include the $)
$ php -v 

PHP 8.4.26 (cli) (built: Sep 24 2026 17:16:18) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.26, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
The above shows that the system is running PHP version 8.4.26 which is vulnerable and must be upgraded

Update PHP libraries

Run the following
$ sudo apt update 

:
119 packages can be upgraded. Run 'apt list --upgradable' to see them.
$ apt list --upgradable | grep php 
WARNING: apt does not have a stable CLI interface. Use with caution in scripts. {Ignore this}

libapache2-mod-php8.4/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-cli/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-common/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-curl/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-gd/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-mbstring/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-mysql/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-opcache/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4-readline/stable-security 8.4.27-1~deb13u1 arm64 [upgradable from: 8.4.26-1~deb13u1]
php8.4/stable-security,stable-security 8.4.27-1~deb13u1 all [upgradable from: 8.4.26-1~deb13u1
The above output shows that PHP is upgradable from version 8.4.26 to version 8.4.27
Run the upgrade:
$ sudo apt -y upgrade

Verify patch and reboot

After upgrading confirm that the new version of PHP has been installed. Run the following:
$ php -v 

PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.27, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies
The above shows that PHP has been succesfully upgraded to version 8.4.27
$ sudo reboot

Advert