Web Client

Mitigating the PHP2Shell (CVE-2026-109618 and CVE-2026-109619) security risk

Your on-premise DocMoto system will use php if you are using DocMoto Sharing, the DocMoto web interface or integrations with Outlook or Slack.

To mitigate the risk from the PHP2Shell vulnerability requires updating the php platform to the latest version on the computer hosting your DocMoto server.

We have listed below the steps required for each of the possible server types hosting your DocMoto server.

As the solution requires familiarity with command line instructions, we strongly recommend a qualified, experienced DevOps professional undertake the work.

Recent Mac using homebrew for php and Apache
For a recent Mac using homebrew for php and Apache. Then in a terminal:      
brew update      
brew upgrade php      
sudo brew services restart httpd

We recommend running brew upgrade​ to upgrade everything to latest version rather than just the php packages.

Rocky 9 or Rocky 10
On a Rocky 9 or Rocky 10 server:      
sudo dnf update      
sudo dnf upgrade $(rpm -qa --queryformat '%{NAME} ' | grep '^php')       
sudo systemctl restart httpd      
sudo systemctl restart php-fpm

We recommend simply doing a complete dnf upgrade​ to upgrade everything to latest version rather than just the php packages. Followed up with a reboot.

CentOS 7
On CentOS 7:      

Not possible because Repos were removed years ago. System will need upgrading to Rocky 9 or Rocky 10.

Older Macs

On Older Macs when php and Apache were part of the operating system the solution is to upgrade the operating system and upgrade to a newer version of DocMoto.