On a fresh RHEL 9 system we installed Checkmk Ultimate Edition yesterday and PHP is present. Has Checkmk an official statement on how to handle the PHP2Shell vulnerability, we acknowledge Red Hat should provide patches for CVE-2026-109618 and CVE-2026-109619 in their repositories but could Checkmk do without PHP is Nagvis is not used for example?
Best regards, Jørgen van der Meulen
Hi,
If you install checkmk as .deb/.rpm, then you just need to update the php shipped via your distro repos.
If you use the docker container or appliance, where checkmk ships php itself you need to update that. For these, new patch releases are already available.
See more in https://checkmk.com/werk/19262
You can of course also deactivate php as well. Only nagvis uses it and that will (highly likely) be deprecated from 3.0 as it is replaced by native and modern Maps
Hi Martinh, or others that might be able to answer,
We use checkmk raw 2.3.0p38 (we haven’t upgraded yet due to needing to extensive API use and they need changes).
We don’t display any maps or have done anything specifically with nagvis, does that mean we aren’t using nagvis or is it an underlying integrated component used for other things internally within checkmk?
When you say deactivate php, is it safe to assume you mean simply remove it, i.e. dnf remove?
I think the quickest path for us at the moment to head this off would be to do that, but just trying to understand what the implications would be in relation to our environment, if any, before I do so.
Thanks, Dave.
The quickest way for you is to run either apt update && apt upgrade or their equivalents (dnf …). Then you will receive a patched version of php from your distribution.
There will also be a 2.3.0 build, but then it is only relevant if you run Checkmk via the Docker image.
PHP in Checkmk is only used for NagVis. If you don’t use NagVis, you don’t need PHP. NagVis is stand-alone, it is just shipped with Checkmk due to popular demand. Removing PHP plainly you don’t need to do, just update it via your system updates.
Simple remove will not be possible as your package management will complain that CMK package needs it. But you can disable the Apache config parts that are relevant for NagVis/PHP.
Hi @martin.hirschvogel @andreas-doehler ,
We have relatively old PHP versions on our CheckMK systems. Is it possible to switch to newer PHP versions without any issues using dnf module update, or could this affect CheckMK? Does CheckMK need to be stopped when updating the version? Do you recommend specific versions for, say, RHEL 8 or RHEL 9? btw: we do not use nagvis.
From my point of view the only viable solution is a current OS release with latest PHP version. Nearly all of my managed systems run on Debian or Ubuntu and they patch and reboot automatically if needed overnight.
the latest php versions on your distro should work as long as you use your distro update mechanism, I’d say. but I don’t use RHEL, I am on Ubuntu on my systems.
In the meantime we publish a knowledge base article: