PHP Security Advisory 2026 (PHP2Shell)
Last updated: 21 October 2026 — patched releases available.
PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, consists of two critical PHP remote code execution vulnerabilities. Unpatched Coolify installations across every v4 release line are affected. Install a patched version below; v4.4.7 is recommended.
Patched Coolify versions
The PHP fix has been backported to every v4 minor release line. If you need to stay on your current minor version, install its security release:
We recommend moving to v4.4.7 wherever possible. Staying on an older minor line addresses PHP2Shell, but leaves out other security fixes that have not been backported.
Self-hosted Coolify users
Update v4.4 from the dashboard
Open Settings → Update → Check now → Update and install v4.4.7. See the upgrade guide for the complete update process.
Stay on a stable v4.0–v4.3 release line
Connect over SSH to the server running Coolify and run:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bashThe script detects your current minor version and installs the corresponding security release from the table. It recreates only the Coolify container, leaving your deployed application containers running. It requires a running, stable Coolify release; beta, RC, and nightly builds are not supported.
For a stopped stable instance, you can use the terminal upgrade process to install v4.4.7 without first restarting the unpatched instance. If you need to stay on v4.0–v4.3 with patch.sh, isolate Coolify from public access before running docker start coolify, then run the patch script over SSH. Keep the isolation in place until patching succeeds.
Move from a v4 beta or older release
First install the v4.0.1 security release from an SSH session on your Coolify server:
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1This version-pinned installation command is the recovery path for a v4 beta or older release. Once v4.0.1 is running, immediately continue to v4.4.7 through Settings → Update → Check now → Update.
Confirm the update before restoring access
Check the version shown in the dashboard, or confirm that the patch script reports a healthy container on the expected security release. If you removed the instance domain or blocked public access earlier, restore only the access you need after verifying the update. You can also keep using your SSH tunnel.
Coolify Cloud users
Coolify Cloud is already patched. You do not need to run any of the instance update commands above; the Coolify team manages the platform's updates.
The Cloud patch protects the Coolify platform. It does not update the PHP applications you deploy on your own servers. Update their PHP runtimes or container images separately and rebuild or redeploy them as needed. This also applies to applications managed by self-hosted Coolify.
If you cannot update immediately
PHP has now published configuration-specific temporary guidance in both official advisories:
Follow the mitigation guidance in both advisories for your PHP configuration. These measures reduce exposure but do not cover every affected execution path. Installing a Coolify release containing the PHP patches is the only complete mitigation for your instance. Do not rely on a single PHP setting or request filter instead of updating.
Cloudflare WAF remains a stopgap
Cloudflare announced WAF rules for known exploit vectors, including on its Free plan. These rules do not patch PHP or guarantee protection against every vector. They only inspect traffic passing through Cloudflare; direct access to your server bypasses them. Update Coolify and your PHP applications even if they are behind Cloudflare.
Keep an unpatched instance offline or isolated
If you cannot install a patched release yet, use one of these isolation measures while you prepare the update. Keep it in place until you have verified that a patched version is running.
Option 1: Stop Coolify (recommended)
Connect over SSH to the server running your Coolify instance and run:
docker stop coolifyThis stops the Coolify container and makes the dashboard and API unavailable, including through your instance domain. You cannot manage resources through Coolify while it is stopped; webhook-triggered deployments and Coolify's background tasks will also be unavailable.
Your already deployed applications, databases, and services will continue running. Leave Docker, the Coolify proxy, and your application containers running.
Use the update path above when you are ready to patch. For a stopped stable instance, the terminal upgrade process can install v4.4.7 and start Coolify afterward. Automatic updates and patch.sh cannot run while Coolify is stopped.
Other security updates in these releases
The v4.4.7 release notes also cover dependency updates beyond PHP:
| Component | Security update | What you need to do |
|---|---|---|
| Sentinel 1.1.2 | Fixes CVE-2026-111943. | Coolify updates Sentinel automatically. |
| cloudflared 2026.10.3 | Addresses the eMudhra certificate compromise. | Update any Cloudflare Tunnel deployments you operate separately as well. |
| Node.js 24.22.1 in Coolify v4.4.7 | Includes fixes for multiple Node.js vulnerabilities. | Update runtimes in your own Node.js applications separately. |
Updating Coolify does not update the runtimes inside your deployed applications. Review those applications separately, including PHP and Node.js workloads, and apply the appropriate runtime or image updates.