Nagios PHP Upgrade: What to Know Before You Start

On October 21, 2026, the PHP project released urgent security fixes, addressing two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Both carry a critical 9.2 CVSS v4.0 score, meaning an unauthorized user could remotely execute code on a vulnerable web server without logging in.

As a result, many organizations are planning a PHP upgrade. This article describes what you need to consider before a PHP upgrade, so your Nagios software keeps working properly.

What This Means for Nagios Monitoring Solutions 

Nagios XI and our other web-based products (including Nagios Fusion) run on the PHP version installed on your server, so applying your Linux vendor’s PHP security updates is important.

When Nagios software is initially installed, it relies on the base version of PHP that the OS vendor installs. The following is mostly geared towards Nagios XI, but it is applicable to our other software as well. 

For example, RHEL 8 installs PHP 7.2, RHEL 9 installs PHP 8.0, and Ubuntu 24.04 LTS installs PHP 8.3. 

As of October 1, 2026, the current versions of our software require a minimum of PHP 7.4 and have been developed and tested to run on PHP 8.4.

How to Check Your System

Check whether your PHP packages include the PHP2Shell fixes.

RHEL-Based Systems

rpm -q --changelog php-common | grep -i CVE-2026-1096

rpm -q --changelog php-common | grep -i CVE-2026-1096

If the command returns CVE-2026-109618 and CVE-2026-109619, your PHP packages include the fixes. If it returns nothing, apply your Linux vendor’s latest PHP updates, then check again.

Debian Systems

Debian 12

apt list | grep php8.2-common

apt list | grep php8.2-common

If they have this version, they have the patch: 8.2.35-1~deb12u1

Debian 13

apt list | grep php8.4-common

apt list | grep php8.4-common

If they have this version, they have the patch: 8.4.27-1~deb13u1

Ubuntu Systems

Ubuntu 22

apt list | grep php8.1-common

apt list | grep php8.1-common

If they have this version, they have the patch: 8.1.2-1ubuntu2.28

Ubuntu 24.04

apt list | grep php8.3-common

apt list | grep php8.3-common

If they have this version, they have the patch: 8.3.6-0ubuntu0.24.04.13

Example Output (RHEL 9)

[root@nagios-xi ~]# php --version
 PHP 8.0.30 (cli) (built: Oct 21 2026 15:47:44) ( NTS gcc x86_64 )
 Copyright (c) The PHP Group
 Zend Engine v4.0.30, Copyright (c) Zend Technologies
    with Zend OPcache v8.0.30, Copyright (c), by Zend Technologies
[root@nagios-xi ~]# rpm -q --changelog php-common | grep -i CVE-2026-10961
  CVE-2026-109618, CVE-2026-109619

Options to Safeguard Your Installations 

Choose the option that fits your situation. For most PHP2Shell concerns, applying your Linux vendor’s security updates is the fastest and safest path.

If You Need a PHP Upgrade for Security or Vulnerability Concerns

Keep in mind that Linux vendors backport security fixes into the PHP versions they ship, so an older version number does not always mean your system is vulnerable. Use the check above, or check with your Linux distribution vendor, to see if you need to upgrade your version of PHP. 

Contact your Linux distribution vendor for the proper method to update your version of PHP and stay inside the parameters listed in this article. 

If You Need a PHP Upgrade Within the Same Major Version

Nagios strongly recommends that you do not upgrade from one major version of PHP to another (for example, from PHP 7.x to PHP 8.x).

For example, if you are running Nagios XI on RHEL 8, with PHP 7.2, you can upgrade to anything from version 7.4 through the highest, available version of PHP 7.x, but do not upgrade to PHP 8.0 or above.

When Nagios performs the initial software installation, it depends on the major version of all the components that ship with that distribution. A PHP upgrade to a different major version can cause issues with the software, as well as with the OS itself.

If You Need a PHP Upgrade to a Higher Major Version

To maintain the integrity of your installed version of Nagios software, migrate your XI instance to a newer release of your Linux distribution that installs the major PHP version you need.

For example, if you are on RHEL 8, running PHP 7.4 and wish to upgrade to PHP 8.3, back up your XI instance and restore it to a new RHEL 9 or RHEL 10 system. Then perform the PHP upgrade on the new instance to PHP 8.3. 

Related Reading: Backing Up And Restoring XI

Before Any PHP Upgrade 

It is important to perform all PHP upgrades in your test environment before your production environment and take a snapshot or clone of your virtual machine so you can roll back if you encounter any problems. 

After making a PHP upgrade, make sure to install the latest SourceGuardian loaders for the new version. See: Nagios XI – Installing Latest SourceGuardian Loaders. 

We are monitoring this situation and will provide updates as more information becomes available.

Additional Resources

• Nagios XI Best Practices
• Nagios Documentation Hub
• Nagios Support Forum