In short: The Nextcloud PHP vulnerability PHP2Shell is not in Nextcloud but in the server's PHP. Because Nextcloud is often a company's central file storage, the consequences of an attack are particularly serious. Patch PHP for web and cron, restart all processes and then check integrity, config.php and the data directory.
Why Nextcloud is particularly critical after PHP2Shell
Many companies, law firms, medical practices and administrations use Nextcloud as their own cloud: contracts, personnel documents, quotes, project files, calendars and contacts. It is often reachable from the internet so that employees can work on the move. According to the PHP team, the PHP flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication.
Anyone who executes code on the Nextcloud server may be able to read all files stored there. Server-side encryption helps only to a limited extent here, because the keys sit on the same system. Ask yourself early which personal data might be affected; general guidance is offered by GDPR reporting obligation: 72 hours.
Nextcloud PHP vulnerability: checking web, cron and containers
Nextcloud uses PHP in two ways. Page requests and synchronisation run through PHP-FPM or mod_php. Background jobs ideally run via system cron with the command-line PHP, as does the administration command occ. Both paths must be patched.
Administrators can see the PHP version in the administration settings via the bundled monitoring app (serverinfo). Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; distribution backports often carry older numbers. Which PHP versions your Nextcloud version supports can be found in the system requirements in the documentation on nextcloud.com.
Many Nextcloud installations run in containers. There, a package update on the host does not help; only a new image with patched PHP and a restart of the containers do. Details are under Patching PHP in Docker containers.
Directories and files in Nextcloud
| Location | Content | What to check |
|---|---|---|
config/config.php |
Database credentials, secret, passwordsalt, trusted_domains |
Inserted code, assess values if you suspect an incident |
data/ |
User files, nextcloud.log, app data |
Ideally outside the document root |
apps/ |
Bundled apps | Integrity check |
custom_apps/ (depending on the installation) |
Apps from the App Store | Unknown or orphaned apps |
themes/ |
Custom design | Foreign JavaScript |
Harmless checks with occ, run as the web server user:
# Show status and version
sudo -u www-data php occ status
# Check core files against the signed originals
sudo -u www-data php occ integrity:check-core
# Show installed and active apps
sudo -u www-data php occ app:list
# List user accounts
sudo -u www-data php occ user:list
The web server's user name differs by distribution. If the integrity check reports modified or additional files, do not replace them immediately; secure the state first. Only then can it be traced later what was changed and since when.
Under "Overview", the administration settings show security and setup warnings. Take them seriously; they often point to a publicly reachable data directory or missing security headers.
Apps, admin accounts and shares
Apps from the Nextcloud App Store extend the platform with office, forms, Talk or integrations. Every app is additional PHP code with its own maintenance. Remove apps that nobody uses, and check whether all apps match the installed Nextcloud version.
Check the "admin" group for unknown members, enable two-factor authentication for all accounts with elevated rights and review app passwords and public share links. A foreign public link to a sensitive folder is a data leak that no file scan reports.
What a Nextcloud update can and cannot do
A Nextcloud update replaces the core and bundled apps and closes known flaws in them. It does not patch PHP, restarts neither PHP-FPM nor cron processes and removes no files in the data directory, no foreign accounts and no shares. Nor does it prove that nothing was leaked between 17 and 21 October 2026. Keep web server and Nextcloud logs from 20 October 2026 onward.
If you suspect an incident, you should also invalidate sessions of desktop and mobile clients as well as app passwords, so that all devices have to sign in again. Also check connected external storage such as network drives or object storage. Their credentials are stored in Nextcloud and may have been read during an attack. Renew these credentials in coordination with the respective responsible parties.
How does PHP SOS help?
- We check the web, cron and container PHP of your Nextcloud and have the patch and restart verified.
- We secure logs and carry out the integrity check as well as a review of apps, accounts and shares.
- Together with you, we assess whether Nextcloud has to remain publicly reachable or belongs behind a VPN.
- As part of server hardening, we place the
datadirectory outside the document root and set permissions and PHP settings properly.
Frequently asked questions
Is Nextcloud affected by PHP2Shell?
Nextcloud runs on PHP. If the server's PHP is not patched, an attacker can, according to the PHP team, execute code without authentication and thereby access the stored files. A Nextcloud update does not close the PHP flaw.
Does Nextcloud's server-side encryption protect against PHP2Shell?
Only to a limited extent. With server-side encryption, the keys sit on the same server. Anyone who can execute code there may also be able to access decrypted content.
How do I check whether Nextcloud files have been modified?
With the command occ integrity:check-core, Nextcloud compares the core files with the signed originals. Conspicuous results should be assessed by a specialist before files are replaced.
Should Nextcloud be reachable from the internet?
That depends on how it is used. If Nextcloud is only needed internally, access exclusively via VPN significantly reduces the attack surface. External sharing then needs a deliberate solution.