PHP2Shell.fyi Check a site

PHP2Shell on Alpine Linux

Alpine ships each PHP branch as its own package, such as php83, and uses the upstream number. A fixed package is the fixed PHP release, for example php83 8.3.36-r0. Update, then restart PHP-FPM or rebuild the container.

Last reviewed . Rules of .

Fixed packages

Source: Alpine security database, community repository: edge, v3.24, v3.23, v3.22, v3.21, and the v3.21 package index. Checked 2026-10-22.
ReleasePackageFixed version
edge, v3.24, v3.23php858.5.12-r0
edge, v3.24, v3.23php848.4.27-r0
edge, v3.24, v3.23php838.3.36-r0
v3.22php848.4.27-r0
v3.22php838.3.36-r0
v3.22php828.2.35-r0
v3.21php828.2.35-r0
v3.21php838.3.36-r0 (in the repository; not in the security database)
v3.21php84no fix yet (8.4.14-r0 is vulnerable)

The v3.21 repository ships php83 8.3.36-r0, a fixed upstream release, but the security database has no entry for it yet. Its php84 is still 8.4.14-r0. On v3.21, move to php83 or php82, or to a newer Alpine release.

Alpine's data lists GHSA-7875-c8px-7q5f for CVE-2026-109619. PHP's own advisory ID is GHSA-6wmf-4rv5-p3rp.

See the installed build

# installed PHP packages and versions
    apk info -v | grep '^php'
    # the command-line and PHP-FPM builds (use your branch)
    php83 -v
    php-fpm83 -v

On Alpine, the version number is the upstream release. 8.3.36-r0 or newer in the 8.3 branch has the fix.

Install the update

apk update && apk upgrade

Restart PHP

# OpenRC (use your branch)
    rc-service php-fpm83 restart

A running PHP process keeps the old code in memory until it stops. Restart Apache, every PHP-FPM pool and any long-running PHP workers, such as queue workers (php2shell.com). In a container, rebuild the image and recreate the container (our advice).

Containers

Most Alpine-based PHP containers do not run OpenRC. Rebuild the image so it installs the fixed package, then recreate the container. A plain container restart keeps the old PHP (our advice).

Some PHP images build PHP from source instead of using Alpine's php83 package. Then apk does not show PHP at all. Run php -v inside the container and compare it with the fixed releases.

Check your site

The php2shell.fyi checker reads the PHP version your site shows in public. A header is a hint, not proof. A distribution build often reports an old number, so confirm the package version on the server. A result never proves that a site is not exposed.

Sources