Vendor advisories and fix status
The PHP project fixed PHP2Shell on 21 October 2026. Each vendor then ships the fix in its own PHP build. Many of these builds keep the old PHP number. Use your vendor's advisory to see if your build has the fix.
Last reviewed . Rules of .
Checked 2026-10-23 on each vendor's own site.
We list only vendors that published a statement on their own site. If your vendor is not here, it can still have a fix. Ask that vendor. Vendors change their entries often, so confirm on the linked page before you decide.
For a broader list of products, see the software list of NCSC-NL, the Dutch National Cyber Security Centre.
What the status words mean
- Fixed: the vendor ships a fixed PHP release (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later), or says that its build has the fix.
- Fixed by backport (old version number): the vendor put the fix into an older PHP build.
php -vstill shows the old number. - Fix in testing: the fix is in a testing channel, not yet in the normal update.
- Affected, no fix yet: the vendor lists the product as affected, with no fix.
- Out of support: the vendor does not fix this release or version.
PHP project
| Product | Status | Advisory | Date |
|---|---|---|---|
| PHP 8.2 to 8.5 | Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. | php.net security advisory | 2026-10-21 |
| CVE-2026-109618 | Fixed in the same releases. | GHSA-w8hw-w9fx-j79w | 2026-10-21 |
| CVE-2026-109619 | Fixed in the same releases. | GHSA-6wmf-4rv5-p3rp | 2026-10-21 |
| PHP 8.1 and older | Out of support. No new release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1. | php.net security advisory | 2026-10-21 |
See Fixed versions and PHP with no fixed release.
Linux distributions
The package versions for Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux and Alpine are on Fixed PHP packages on Linux. Compare the full package version, not php -v.
| Distribution | Status | Advisory | Date |
|---|---|---|---|
| Ubuntu | Fixed by backport (old version number) on 26.10, 26.04, 24.04 and 22.04, and with Ubuntu Pro on 20.04 to 14.04. 25.04 and 25.10: out of support. Packages | USN-8948-1, USN-8948-2 | 2026-10-21 |
| Debian | Fixed in 13 trixie, 12 bookworm and php8.4 in unstable. Testing (forky) is affected, no fix yet. Packages | DSA-6574-1, DLA-4848-1 | — |
| Red Hat Enterprise Linux | Fixed in RHEL 8, 9 and 10, some streams by backport. RHEL 9 php:8.4 module, and RHEL 7 for CVE-2026-109619 only: affected, no fix yet. RHEL 6: out of support. Packages | RHSB-2026-013 | 2026-10-21 |
| AlmaLinux | Fixed on AlmaLinux 8, 9 and 10, most streams by backport (old version number). Packages | AlmaLinux announcement, ALSA-2026:87070 and others | 2026-10-21 |
| Rocky Linux | Fixed on Rocky 8, 9 and 10, some streams by backport. Packages | RLSA-2026:87070 and others | 2026-10-22 |
| Alpine Linux | Fixed in edge and v3.22 to v3.24. v3.21: php82 fixed. The security database has no entry for php83 and php84. The v3.21 repository ships php83 8.3.36-r0 (a fixed upstream release) and php84 8.4.14-r0 (older than 8.4.27). Packages | Alpine security database | — |
| Amazon Linux 2023 | Fixed: php8.2 8.2.35, php8.3 8.3.36, php8.4 8.4.27, php8.5 8.5.12. | ALAS2023-2026-3301, 3302, 3303, 3304 | 2026-10-22 |
| Amazon Linux 2023, php8.1 | No fix planned. Amazon: "No Fix Planned". | Amazon Linux CVE page | — |
| Amazon Linux 2, PHP 8.2 Extra | Fixed in php 8.2.35. | ALAS2PHP8.2-2026-015 | 2026-10-22 |
| Amazon Linux 2, core php | Out of support. Amazon: "No Fix Planned". | Amazon Linux CVE page | — |
| Amazon Linux 2027 Preview | Fixed in php8.5. | ALAS2027-2026-243 | 2026-10-21 |
| Oracle Linux 10 | Fixed in php and php8.4. | ELSA-2026-87070, ELSA-2026-87071 | 2026-10-21 |
| Oracle Linux 9 | Fixed in php, php:8.2 and php:8.3. | ELSA-2026-87151, ELSA-2026-87072, ELSA-2026-87079 | 2026-10-21, 2026-10-22 |
| Oracle Linux 8 | Fixed in php:7.4 and php:8.2. | ELSA-2026-87080, ELSA-2026-87073 | 2026-10-21, 2026-10-22 |
| SUSE Linux Enterprise Server 16.0 | Fixed in php8 8.4.27-160000.1.1. | SUSE CVE page | — |
| SUSE Linux Enterprise Server 15 SP7 | Fixed in php8 8.3.36-150700.3.24.1. php7 7.4.33-150400.4.81.1 (Legacy module): fixed by backport (old version number). | SUSE-SU-2026:4844-1, SUSE-SU-2026:4853-1 | 2026-10-21, 2026-10-22 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed in php8 8.2.35-150600.3.39.1. | SUSE-SU-2026:4843-1 | 2026-10-21 |
| SUSE Linux Enterprise Server 15 SP4-LTSS, SP5-LTSS | Fixed by backport (old version number): php8 8.0.30-150400.4.80.1, php7 7.4.33-150400.4.81.1. | SUSE-SU-2026:4852-1, SUSE-SU-2026:4853-1 | 2026-10-22 |
| SUSE Linux Enterprise Server 12 SP5 | Fixed by backport (old version number): php74 7.4.33-1.74.1. | SUSE CVE page | — |
| openSUSE Tumbleweed | Fixed in php8 8.5.12-1.1. | SUSE CVE page | — |
| openSUSE Leap 16.0 and 16.1, SUSE Linux Enterprise Server 16.1 and 16.2 | Affected, no fix yet. SUSE's overall state is "Pending". | SUSE CVE page | — |
| openSUSE Leap 15.3 to 15.6 | Out of support. SUSE lists them as affected and past their end of life. | SUSE CVE page | — |
| Fedora 45 | Fix in testing: php-8.5.12-1.fc45. | FEDORA-2026-a9354b8a1e | — |
| Fedora 44 | Fixed in php-8.5.12-1.fc44. | FEDORA-2026-a9eba4bbc3 | 2026-10-21 |
| Fedora 43 | Fixed in php-8.4.27-2.fc43. | FEDORA-2026-d5f8446449 | 2026-10-22 |
| Arch Linux | Fixed: php 8.5.12-1, php-legacy 8.3.36-1. | ASA-202610-1, ASA-202610-2 | 2026-10-21 |
| Gentoo | Fixed: dev-lang/php 8.5.12, 8.4.27, 8.3.36 and 8.2.35. | GLSA 202610-02 | 2026-10-21 |
| FreeBSD ports | Fixed: php82 8.2.35, php83 8.3.36, php84 8.4.27, php85 8.5.12, php86 8.6.0.r4. | VuXML d8e16d08-cd2f-11f1-8135-8447094a420f | 2026-10-21 |
SUSE also lists older SUSE Linux Enterprise 15 service packs without LTSS, and several SUSE Manager versions, as affected. See the SUSE CVE page for your product.
Container images
| Image | Status | Advisory | Date |
|---|---|---|---|
| Docker official php image | Fixed: the supported release tags are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The list also has the 8.6.0RC4 release candidate. | Supported tags | — |
| Red Hat Hardened Images | Fixed in php 8.5.12-1.hum1. | RHSA-2026:87414 | 2026-10-21 |
| Images built on RHEL or UBI | Red Hat says to rebuild your containers when the base images are updated. | RHSB-2026-013 | 2026-10-21 |
| Red Hat OpenShift Dev Spaces, udi-rhel9 | Affected, no fix yet. | Red Hat VEX data | — |
| SUSE BCI php, php-apache, php-fpm | Affected, no fix yet. | SUSE CVE page | — |
A running container keeps its old PHP.
Our advice Pull the fixed base image, rebuild your image and recreate the container. Then check the PHP version inside the container, as shown in how to check your PHP version.
Hosting panels and PHP builds
| Product | Status | Advisory | Date |
|---|---|---|---|
| cPanel EasyApache 4, ea-php82 to ea-php85 | Fixed: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. cPanel guide | EasyApache 4 25.91 | 2026-10-21 |
| cPanel EasyApache 4, ea-php74, ea-php80, ea-php81 | Fixed by backport (old version number). Version 25.92 rebuilds their meta packages so that the change log lists the backport. | EasyApache 4 25.91, 25.92 | 2026-10-21 |
| CloudLinux ea-php52 to ea-php85 | Fixed by backport (old version number) on CloudLinux 7 to 10, for example ea-php83 8.3.35-2.elX.cloudlinux.2. | CloudLinux post and status updates | 2026-10-21 |
| CloudLinux alt-php | Fixed by backport (old version number) in the stable repositories for CloudLinux 7, 8, 9 and CloudLinux for Ubuntu 22.04. On CloudLinux 10, alt-php 5.2 is in the CloudLinux repository and the other versions are in the TuxCare ELS ALT PHP repository. | CloudLinux post and status updates | 2026-10-22 |
| CloudLinux native php packages | Fixed in the stable channel for every affected version. Some by backport (old version number). | CloudLinux post and status updates | 2026-10-22 |
| Plesk PHP 8.2 to 8.5 | Fixed: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Plesk guide | Plesk change log, PHP Updates | 2026-10-21 |
| Plesk PHP 7.4, 8.0, 8.1 on Linux | Fixed by backport (old version number): 7.4.33, 8.0.30 and 8.1.34. | Plesk change log, PHP Updates | 2026-10-21 |
| Plesk's own PHP (sw-engine) | Fixed in 8.4.27. | Plesk Obsidian 18.0.81 Update 4, 18.0.80 Update 11 | 2026-10-21 |
CloudLinux says to check its backported builds by the CVE IDs in the package change log, for example rpm -q --changelog ea-php84-php-cli | grep -E 'CVE-2026-(109618|109619)'.
Cloud and PaaS
| Platform | Status | What the vendor says to do | Advisory and date |
|---|---|---|---|
| Heroku | Fixed: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1.34 on the Heroku-22 stack is rebuilt with the backport. | "Redeploy your apps to pick up the fixed versions." | Heroku change log, 2026-10-21 |
| AWS Elastic Beanstalk, Amazon Linux 2023 PHP platforms | Fixed in platform version 4.13.13: PHP 8.5.12 and 8.4.27 (21 October), PHP 8.3.36 and 8.2.35 (22 October). | — Our advice Move each environment to platform version 4.13.13 or later. | Release notes, 8.5 and 8.4, 8.3 and 8.2 |
| Azure App Service on Linux, built-in PHP | Fixed in the Latest and Standard release channels: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The Extended channel gets the fix last. End-of-life PHP versions get no patch. | Switch from Extended to Standard or Latest. Upgrade end-of-life PHP versions. | App Service team blog, 2026-10-21 |
| Azure App Service on Windows, built-in PHP | Out of support. The built-in runtimes are end of life. No patch is planned. | Move to App Service on Linux, or bring your own fixed PHP runtime. | App Service team blog, 2026-10-21 |
| Azure App Service, custom containers | App Service does not patch them. | Rebuild your images with the fixed PHP versions. | App Service team blog, 2026-10-21 |
| Google Cloud | Google Cloud itself is not vulnerable. PHP workloads on Google Cloud can be. | Redeploy your workloads with updated dependencies. | GCP-2026-070, 2026-10-21 |
| Google App Engine standard, PHP | Fixed in all supported versions of PHP 8.2 and later. | Redeploy your resources with updated dependencies. | App Engine release notes, 2026-10-22 |
| Upsun Cloud | Fixed in every php image from 7.4 to 8.5. 7.4, 8.0 and 8.1 by backport. 7.3 and older: no patch. The composable image update is still in progress. | 8.4 or 8.5: nothing. 7.4 to 8.3: upgrade to 8.4 or later. 7.3 or older: upgrade now. | Upsun developer center, 2026-10-22 |
| Pantheon | Fixed: 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and the LTS branches 5.6 to 8.1 through Pantheon's LTS vendor. The rollout is complete. | "No action is required from customers." | Pantheon status page, resolved 2026-10-22 |
Our advice After the platform update, check the PHP version your app runs. A redeploy or restart can be needed before a running app uses the fixed PHP.
Check your site
The php2shell.fyi checker reads the PHP version your site shows in public. A header is a hint, not proof. A vendor build often reports an old number, so confirm the build with your vendor or on the server.
Sources
- php.net: Security advisory, 21 October 2026
- php-src: GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- php-src: GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- NCSC-NL: php2shell software list
- Red Hat: RHSB-2026-013
- Amazon Linux: CVE-2026-109618
- Oracle Linux: CVE-2026-109618
- SUSE: CVE-2026-109618
- Arch Linux: CVE-2026-109618
- CloudLinux: package status for CVE-2026-109618 and CVE-2026-109619
- cPanel: EasyApache 4 change log 25
- Plesk: Obsidian change log
- php2shell.com: research site