Unraid OS 7.3.4 went out on October 22, three days before this article, and the release notes read like routine maintenance: 44 packages bumped, a handful of driver tweaks, nothing flagged as urgent. Dig into the changelog, though, and one line stands out. PHP moved from 8.4.26-1_LT to 8.4.27-1_LT, exactly the version PHP’s own security team shipped a day earlier to kill two critical, unauthenticated remote-code-execution bugs that researchers are calling PHP2Shell.
What actually shipped in 7.3.4
The official release notes describe the PHP bump only as a fix for “multiple reported PHP vulnerabilities,” without naming CVEs or PHP2Shell directly. That’s worth being precise about: Unraid hasn’t confirmed the connection in those terms. What lines up is the version number and the timing. PHP’s maintainers patched the flaw in 8.4.27 (along with 8.5.12, 8.3.36, and 8.2.35) on October 21. Unraid shipped that exact patched build the very next day. Given how fast that turnaround is, treating 7.3.4 as the fix for PHP2Shell on Unraid is a reasonable inference from the version match, not something the vendor spelled out.
PHP isn’t a side detail on Unraid. The web GUI runs on it, and depending on how a server is configured, so do several plugins. That’s exactly the kind of exposure PHP2Shell targets.
Why PHP2Shell got attention
PHP2Shell is the name attached to two linked flaws, tracked as CVE-2026-109618 and CVE-2026-109619, covered in detail by BleepingComputer on October 21. Both are unauthenticated and both can end in remote code execution, which is about as bad as a web-facing bug gets.
- CVE-2026-109618: a chain of weaknesses that triggers an out-of-memory condition at the end of an abnormal request, corrupting memory in a way that can be turned into RCE.
- CVE-2026-109619: a use-after-free bug that exploits stale global state left over from a prior request, leading to a memory leak and, from there, code execution.
Risk varies by server setup. Mod_php under Apache is described as the worst-case configuration, with PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed also named as exposed to varying degrees. Some outlets put the share of web infrastructure running PHP in some form at around 70 percent, which is part of why this got emergency, same-day patches rather than waiting for a scheduled release.
The other 43 packages
PHP wasn’t the only thing with CVEs attached in this release. A few of the bigger ones:
- curl 8.22.0 to 8.23.0 — 21 CVEs
- openssl 3.5.8 to 3.5.9 — 13 CVEs
- xorg-server 21.1.24 to 21.1.25 — 11 CVEs
- libXi 1.8.3 to 1.8.4 — 8 CVEs
- libX11 1.8.13 to 1.8.14 — 4 CVEs
- nginx 1.30.4 to 1.30.6 — fixes CVE-2026-15176
- libpng 1.6.58 to 1.6.59 — fixes CVE-2026-46675
- libXtst, libXpm, and libXrender — one or two CVEs apiece
On top of that, 7.3.4 bumps the Linux kernel to 6.18.54-Unraid, moves ZFS to 2.4.4, updates Docker Engine to 29.8.2 and the Unraid API to 4.37.5-2, and refreshes several Intel, MediaTek, and Realtek network drivers along with some Hyper-V improvements. None of that is security-critical on its own, but it’s a lot of ground covered in one point release.
Should you update now?
Yes, and there’s not much nuance to add. If your server’s web GUI is reachable from outside your LAN, even through a reverse proxy, the PHP fix alone justifies moving to 7.3.4 promptly. If it’s strictly local-network-only, the risk is lower but the other ~50 CVEs patched in curl, OpenSSL, and the X11 libraries are still worth having. The update is available now from the Unraid GUI under Tools > Update OS, or through the usual plugin update path if you’re running a community distribution of it.
Unraid has shipped security fixes fast before, and the vendor’s closed-source, paid-license model is part of the backstory for how that process works — we cover where that model came from in our history of Unraid. For a broader look at what Unraid is and how it stacks up against TrueNAS and OpenMediaVault, see our Unraid overview.