PHP2Shell: How to Patch and Upgrade Your Moodle Server

Introduction

This guide shows you how to protect your Moodle server from the PHP2Shell vulnerability. You can patch the server you already have, or move your site to a fresh instance from our latest image, which also brings you up to the latest Moodle release.

What is PHP2Shell?

PHP2Shell is the name given to two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026. They affect PHP 5.4 through 8.5 and allow an attacker to run their own code on a web server just by sending it requests. Moodle is written in PHP, so every Moodle server is at risk until PHP is updated, whatever Moodle version it runs.

The flaws are being exploited in the wild, so treat this as urgent. Updating PHP is the only complete fix. The PHP developers have said the temporary workarounds that have been published are not enough on their own.

Important: the fix comes from updating PHP, not Moodle. Upgrading Moodle alone won’t protect you, but patching PHP will, even on an older Moodle version.

You have two ways to get protected:

1. Patch your existing server: the quickest option, and the right one for most people.
2. Launch a new instance from our latest image and migrate: best if your server runs an operating system that no longer gets security updates, or if you also want to move to the latest Moodle.

Option 1: Patch Your Existing Server

Step 1: Back Up First

Before changing anything, take a snapshot of your server’s disk:

• AWS: EC2 console → Volumes → select your instance’s volume → Actions → Create snapshot.
• Azure: Azure Portal → your VM → Disks → select the OS disk → Create snapshot.

Step 2: Find Out Which Operating System You Have

Our Moodle images have been built on Ubuntu in the past and are built on AlmaLinux today. Log in over SSH and run:

cat /etc/os-release
php -v

Step 3: Install the Updates

On Ubuntu:

sudo apt update
sudo apt upgrade -y
sudo systemctl restart apache2

On AlmaLinux:

sudo dnf upgrade -y
sudo systemctl restart php-fpm httpd

Step 4: Confirm You Are Patched

On Ubuntu, check the installed PHP package version:

dpkg -l | grep -E '^ii +php[0-9.]+-(cli|common) '

It should be the same as, or newer than, the version for your Ubuntu release:

Ubuntu release	PHP	Patched package version
24.04	8.3	8.3.6-0ubuntu0.24.04.13
22.04	8.1	8.1.2-1ubuntu2.28

On AlmaLinux, check that the PHP package mentions the fix in its changelog:

rpm -q --changelog php-cli | grep -i 'CVE-2026-109618'

If you see a matching line, you are patched. If not, the fix may not have reached your mirror yet: run the update again later. In the meantime, consider restricting access to your site.

If php -v reports one of the fixed upstream releases (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer), you are also patched.

Running an older operating system? Ubuntu 20.04 and older no longer receive free security updates, so their PHP will not get this fix. Option 2 is the safe way forward.

Step 5: Check for Signs of Compromise

PHP2Shell was exploited before many servers were patched, so take a few minutes to check:

1. Administrator accounts: in Moodle, go to Site administration → Users → Permissions → Site administrators and make sure you recognise every account listed.
2. Recently changed code: this lists PHP files in the Moodle code folder changed since mid-October 2026. Files from upgrades or plugin installs you ran yourself are expected; look for anything you don’t recognise:

sudo find /var/www/html/moodle -name '*.php' -newermt '2026-10-17' -ls

If you find something suspicious, move to a fresh instance (Option 2), and change your administrator and database passwords.

Option 2: Launch a New Instance and Migrate (and Upgrade Moodle)

Our latest Moodle images already include the PHP2Shell fix. Every image build is automatically checked for it before release. They run Moodle 5.2 on AlmaLinux 10 with PHP 8.3 and MariaDB, so moving to a new instance gets you the fix, the latest Moodle and a supported operating system in one go. It’s also the way forward if you’ve received a notice that the image version you originally launched is being retired.

Step 1: Check Your Current Moodle Version

In Moodle, go to Site administration → Notifications; your version is shown at the bottom of the page.

Moodle 5.2 can upgrade sites running Moodle 4.4 or later. If you’re on an older version, first upgrade your existing site to Moodle 4.5 (LTS), then continue with the steps below. See Upgrading in the Moodle documentation.

Also make a list of any third-party plugins you use (Site administration → Plugins → Plugins overview → Additional plugins), and check that each has a version that supports Moodle 5.2.

Step 2: Launch the Latest Image

Launch a new instance from our image on your cloud of choice:

• Launch on AWS →
• Launch on Azure →

Once it has finished its first boot, its generated credentials are stored at:

/opt/moodle-info/generated-credentials.txt

You don’t need to complete the Moodle setup on the new instance; your existing site will replace it.

Step 3: Back Up Your Site on the Old Server

Put your site into maintenance mode (Site administration → Server → Maintenance mode) so nothing changes during the move. Then, on the old server, find your database name, table prefix and data folder:

grep -E 'dbname|prefix|dataroot|passwordsaltmain' /var/www/html/moodle/config.php

Back up the database and the data folder (our images use moodle and /opt/moodledata; use the values from your config.php if they’re different):

sudo mysqldump --single-transaction moodle > ~/moodle.sql
sudo tar czf ~/moodledata.tar.gz -C /opt moodledata

Step 4: Copy the Backup to the New Server

From the old server (use your new instance’s username and IP address):

scp ~/moodle.sql ~/moodledata.tar.gz YOUR-USER@NEW-SERVER-IP:~

Your data folder may be large, so allow time for this. Alternatively, download the files to your computer with SFTP and upload them to the new server.

Step 5: Restore on the New Server

On the new server, replace the fresh database with your site’s database:

sudo mysql -e "DROP DATABASE moodle; CREATE DATABASE moodle DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
sudo mysql moodle < ~/moodle.sql

Replace the fresh data folder with yours:

sudo mv /opt/moodledata /opt/moodledata.new
sudo tar xzf ~/moodledata.tar.gz -C /opt
sudo chown -R apache:apache /opt/moodledata
sudo restorecon -R /opt/moodledata

Then edit /var/www/html/moodle/config.php on the new server. Keep its database username and password, and make sure these match your old site:

• $CFG->prefix: your old table prefix (usually mdl_).
• $CFG->wwwroot: your site’s address, e.g. https://moodle.example.com.
• $CFG->passwordsaltmain: if your old config.php had one, copy it across exactly, or some users may not be able to log in.

Install your third-party plugins (the Moodle 5.2 versions) into the new site’s code folder.

Step 6: Run the Moodle Upgrade

Find the upgrade script and run it as the web server user:

cd /var/www/html/moodle
sudo find . -path '*admin/cli/upgrade.php'
sudo -u apache php ./public/admin/cli/upgrade.php

Use the path that find printed in the last command if it’s different. The upgrade can take a while on a large site. When it finishes, purge the caches:

sudo -u apache php ./public/admin/cli/purge_caches.php

Step 7: Switch Over

Update your DNS record to the new server’s IP address, set up your SSL certificate again, log in as an administrator, and check Site administration → Notifications for anything that needs attention. Then turn off maintenance mode. Keep the old server stopped (not deleted) for a few days until you’re happy everything is working, then delete it and its snapshots.

Our new images run AlmaLinux rather than Ubuntu, so day-to-day commands differ slightly: dnf instead of apt, httpd instead of apache2, and the web server user is apache instead of www-data.

Conclusion

PHP2Shell is serious, but the fix is simple: update PHP. On most servers that’s a single update and a restart. If your server is on an older operating system, or you’re ready to move to the latest Moodle, a fresh instance from our latest image takes care of everything at once.

Need a hand? Our support team can help you patch your server or migrate your Moodle site. Just reach out to support@solvedevops.com with your current Moodle version and the plugins you use.