PHP 7.4, 8.0 and 8.1: no fixed release
The PHP project makes no new releases for PHP 8.1 and older. For PHP2Shell, its security team published source backports for 7.4, 8.0 and 8.1. You need a vendor build with the fix, a build from that source, or a move to PHP 8.2 or newer.
Last reviewed . Rules of .
What the PHP project published
Because the flaws are severe, the PHP security team published minimal source backports for three end-of-life branches:
They are source code only, for people who build PHP themselves or have no long-term support vendor. They come with no new version number, so a build from them still reports 8.1.x, 8.0.x or 7.4.x.
The PHP project has nothing for PHP 7.3 and older. The researchers at php2shell.com found affected releases as far back as PHP 5.4.
| Branch | Security support ended | From the PHP project |
|---|---|---|
| 8.1 | Ended 31 Dec 2025 | Source backport only |
| 8.0 | Ended 26 Nov 2023 | Source backport only |
| 7.4 | Ended 28 Nov 2022 | Source backport only |
| 7.3 and older | Ended | Nothing |
Vendor builds with the fix
These builds keep the old PHP number. Compare the package version with this table, not php -v.
| Vendor and release | Branch | Fixed build | Source |
|---|---|---|---|
| Ubuntu 22.04 | 8.1 | 8.1.2-1ubuntu2.28 | USN-8948-1 |
| Ubuntu 20.04 | 7.4 | 7.4.3-4ubuntu2.29+esm5 | USN-8948-2. Needs Ubuntu Pro. |
| RHEL 9 and Rocky 9 | 8.0 (default) | 8.0.30-8.el9_8.1 | RHSA-2026:87151, RLSA-2026:87151 |
| RHEL 8 | 7.4 (php:7.4) | 7.4.33-8.module+el8.10.0+25117+30337cca | RHSA-2026:87080 |
| Rocky 8 | 7.4 (php:7.4) | 7.4.33-8.module+el8.10.0+40393+c071e357 | RLSA-2026:87080 |
| AlmaLinux 9 | 8.0 (default) | php-8.0.30-8.el9_8.alma.1 | AlmaLinux |
| AlmaLinux 9 | 8.1 (php:8.1) | php-8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | AlmaLinux. Past its life cycle. |
| AlmaLinux 8 | 8.0 (php:8.0) | php-8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | AlmaLinux. Past its life cycle. |
| AlmaLinux 8 | 7.4 (php:7.4) | php-7.4.33-8.module_el8.10.0+4321+cf5fd4bb | AlmaLinux |
| cPanel EasyApache 4 | 8.1, 8.0, 7.4 | ea-php81, ea-php80, ea-php74 from 25.91 | Fix backported, version number unchanged. |
Debian and Alpine list no fixed packages for these branches. Ubuntu and AlmaLinux also fixed some older branches; see Linux packages.
Other vendors: if you pay for extended support of an old PHP, or your host runs alt-php packages, ask that vendor whether its build contains the CVE-2026-109618 and CVE-2026-109619 fix.
Move to a supported branch
The lasting fix is a supported branch. PHP 8.2 security support ends on 31 December 2026, so 8.3 or newer gives you more time (our advice). Check your app's PHP requirements first: see the platform guides.
- RHEL, AlmaLinux and Rocky Linux: switch the module stream. See the commands.
- Plesk, DirectAdmin and aaPanel: install a newer PHP and switch the site. See Plesk, DirectAdmin and aaPanel.
- Shared hosting: ask your host. See cPanel and shared hosting.
If you cannot update today
These measures from the php.net advisory make some attacks harder. They are not a fix. Details and examples are on Mitigations.
- Set
memory_limit=-1withphp_admin_value, and cap memory outside PHP with a container or cgroup limit. Do not useRLIMIT_ASorRLIMIT_DATA. - Set a low
post_max_size:8Mwithout file uploads,32Mwith them. - Set
session.upload_progress.enabled=0inphp.ini, the FPM pool or the server config, not withini_set()or.user.ini. - Limit request sizes, input fields and multipart parts at the web server or proxy.
Restart every PHP worker after a change.
How to tell whether your build has the fix
php -v shows the same number before and after a vendor fix. Read the package version on the server and compare it with the table above: Ubuntu, RHEL, AlmaLinux and Rocky Linux. On shared hosting, ask your host for the exact build.
Check your site
The php2shell.fyi checker reads the PHP version your site shows in public. A header is a hint, not proof. A distribution build often reports an old number, so confirm the package version on the server. A result never proves that a site is not exposed.
Sources
- php.net: Supported versions
- php.net: Unsupported branches
- php-src: 8.1 source backport
- php-src: 8.0 source backport
- php-src: 7.4 source backport
- Ubuntu: USN-8948-1 and USN-8948-2
- Red Hat: RHSB-2026-013
- AlmaLinux: patched PHP packages released, 2026-10-21
- cPanel: EasyApache 4 change log 25
- php.net: Security advisory, 21 October 2026
- php-src: GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- php-src: GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- php2shell.com: research site