PHP2Shell Fixed Versions: What to Install for Every PHP Branch

As of 23 October 2026, the PHP project's fixed releases for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on 21 October 2026. If your server runs an older patch release on any of those branches, it is vulnerable until you update. PHP 8.1 and older get no official release, only minimal source backports and fixes from Linux distributions and long-term support vendors.

There is one catch that confuses almost everyone. Linux distributions such as Ubuntu, Debian, Red Hat and AlmaLinux usually fix the bug inside their own packages without changing the PHP version number. A server that reports PHP 8.3.6 can be fully patched, and a server that reports 8.3.35 is not. The version string alone cannot tell you whether you are safe.

This page is the reference table: every PHP branch, the release that fixes it, its support status, and what to do. It also lists the vendor packages confirmed as of today and explains how to prove a server is patched.

Fixed PHP Versions by Branch

The PHP project's 21 October advisory says: "Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35." The table adds the support dates from PHP's supported versions page, as shown on 23 October 2026.

The affected ranges in PHP's advisories are below 8.2.35, below 8.3.36, below 8.4.27 and below 8.5.12. PHP's advisories only list supported branches, but researchers including Wiz, Calif and watchTowr report that older branches back to PHP 5.4 are affected too. Treat every PHP installation as in scope.

Why "PHP 8.3" Is Not an Answer

When a host or developer tells you "we're on PHP 8.3," that tells you the branch, not whether you are patched. Every branch has many patch releases, and only the newest ones contain the fix.

• PHP 8.3.35 (from upstream PHP) is vulnerable.
• PHP 8.3.36 (from upstream PHP) is fixed.
• PHP 8.3.6 on Ubuntu 24.04 LTS is fixed if the package version is 8.3.6-0ubuntu0.24.04.13 or later, according to Ubuntu's notice.

So you need two pieces of information: where your PHP comes from (php.net, your Linux distribution, your control panel vendor, or a container image), and the exact build. Our guide on how to check your website's PHP version walks through finding both.

Why Distro Patches Keep the Old Version Number

Linux distributions "backport" security fixes. They copy the fix into the version they already ship rather than moving everyone to a new upstream release, because a new release could change behavior and break sites. Debian's security FAQ explains it directly: "Instead of upgrading to a new release we backport security fixes to the version that was shipped in the stable release."

Red Hat's backporting policy warns that "just looking at the version number of a package will not tell them if they are vulnerable or not," and that scanners which check only version numbers produce false positives. AlmaLinux says the same about PHP2Shell specifically: "Don't rely on php -v: our fixes are backported, so the upstream PHP version number doesn't change."

The reverse is also true. A version number that looks new does not prove the build is fixed if it came from a source that has not shipped a patch yet.

Distribution and Vendor Packages Confirmed So Far

PHP says "Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages." This table lists what vendors had published as of 23 October 2026. It changes daily, so check the linked source before relying on it.

Sources: Ubuntu USN-8948-1, the Debian security tracker, Red Hat's security data, AlmaLinux's PHP2Shell post, CloudLinux's PHP2Shell post, cPanel's news page, Plesk's support article and Docker Hub.

How to Confirm You Have the Fixed Build

Use the method that matches where your PHP comes from. Replace the version numbers in these examples with your own.

Ubuntu and Debian

Ubuntu's notice says "a standard system update will make all the necessary changes," and Ubuntu recommends updating everything rather than cherry-picking packages. Debian's FAQ says you can confirm a fix by "comparing its exact version number with the version indicated in the Debian Security Advisory" or by reading the changelog with apt-get changelog package-name.

sudo apt update && sudo apt upgrade
apt-get changelog php8.3-fpm (example: use the package name for your version)

Compare the installed package version with the "Fixed in" version in the table above or the vendor notice. A changelog entry naming CVE-2026-109618 and CVE-2026-109619 is the clearest proof.

AlmaLinux, Red Hat and similar

AlmaLinux documents these commands, and says to compare the result "against the patched package versions":

sudo dnf clean metadata && sudo dnf upgrade 'php*'
rpm -q php-common

On AlmaLinux 10 with PHP 8.4, AlmaLinux says to check rpm -q php8.4-common instead. Red Hat attaches CVE names to its advisories, so you can also match your installed package against the RHSA listed for your release.

cPanel, Plesk and managed hosting

If PHP comes from a control panel, only the panel's packages matter. AlmaLinux points out that its packages "only update PHP installed from AlmaLinux's own repositories." Ask your host which build serves your site and whether it includes the PHP2Shell fix. CloudLinux also notes that hosting servers "often run several PHP versions side by side," so every version that serves a website needs updating.

Containers

For the Docker official php image, rebuild from a fixed tag (for example php:8.3.36, using your own branch) and redeploy. Base images from other publishers have their own schedules, so check each one. Pulling a new image does nothing until the running containers are replaced.

Restart Every PHP Worker After Updating

Installing the package is not the last step. PHP worker processes that started before the update keep running the old, vulnerable code. watchTowr's guidance is short: "Restart every PHP worker after updating so the fix takes effect." The php2shell.com site says to "restart Apache, PHP-FPM and any long-running PHP workers."

• PHP-FPM on Ubuntu or Debian: sudo systemctl restart php8.3-fpm (replace 8.3 with your version)
• PHP-FPM on AlmaLinux or RHEL: sudo systemctl restart php-fpm
• Apache with mod_php on AlmaLinux 8: sudo systemctl restart httpd
• cPanel servers with ea-php: CloudLinux documents /scripts/restartsrv_httpd and /scripts/restartsrv_apache_php_fpm

Long-running application servers and worker-mode setups need a restart too. If you cannot restart yourself, ask your host to confirm they did.

If You Are on PHP 8.1, 8.0, 7.4 or Older

PHP's advisory says "PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version." You have three paths:

1. Vendor package. Ubuntu, AlmaLinux, CloudLinux, cPanel and Plesk have shipped patched builds for some end-of-life versions. This is the fastest route if your host uses one of them.
2. Source backport. The PHP security team published "minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor." This is only for teams that already compile PHP themselves.
3. Upgrade. Move to PHP 8.3 or newer. This takes testing, because old plugins, themes and custom code are what usually break. Our guide to WordPress staging sites shows how to test first.

Government agencies have been blunt about old versions. CISA says organizations that "continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated." If an upgrade will take days, read our guide to PHP2Shell interim mitigations for the settings that reduce exposure in the meantime. None of them is a fix.

What the Fixed Releases Do Not Cover

On 23 October 2026, PHP published an informational advisory for a related issue, CVE-2026-115560, which affects patched releases including 8.5.12. PHP calls it unlikely: it needs an unusual combination of session settings changed at runtime, and session upload progress still turned on. PHP suggests setting session.upload_progress.enabled=0 "until the next regular bugfix release," and will not ship an out-of-band release for it, according to CERT-EU.

Patching also does not undo anything that happened before you patched. Attempts were reported from 17 October 2026, before disclosure. If you are worried your site was touched, see was my site hacked through PHP2Shell. For a broader patch routine, our security patching best practices guide applies here too.

Planning Past 31 December 2026

PHP 8.2.35 fixes PHP2Shell, but PHP says "PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date." The next serious PHP bug after that date will have no upstream fix for 8.2. If you are updating now, consider whether you can go straight to 8.3 or 8.4 instead. For WordPress sites, our WordPress PHP versions guide covers compatibility and safe upgrades.

Conclusion

As of 23 October 2026, the fix for PHP2Shell is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package that backports the same patch. Check the exact build and where it comes from, not just the branch, then restart every PHP worker. If you are on 8.1 or older, use a vendor package or upgrade, and use mitigations only as a stopgap. If you need help confirming or applying the update, our emergency PHP patching team can do it with you. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions