PHP 7.4 and PHP2Shell: No Official Fix. Your Options

As of 23 October 2026, PHP 7.4 has no official fixed release for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The branch reached end of life on 28 November 2022, and its last release, 7.4.33, is vulnerable. The PHP security team published a minimal source backport, and several vendors ship patched 7.4 packages, but many of those fixes sit behind paid support plans.

PHP 7.4 is still everywhere because it is the minimum PHP version for current WordPress. That makes it one of the most common end-of-life versions on small business sites. Ubuntu 20.04 and Debian 11 both ship it as their default PHP, and on both the fix now needs a paid or extended support service.

A patched 7.4 buys time. It does not solve the underlying problem. The move from 7.4 to PHP 8 is the hardest PHP upgrade most sites will face, so it needs a plan and testing. This page covers both.

PHP 7.4's Status After PHP2Shell

PHP 7.4.0 came out on 28 November 2019. According to PHP's end-of-life page, the branch ended on 28 November 2022, with 7.4.33 (3 November 2022) as the final release. That is nearly four years without upstream security fixes before PHP2Shell.

The fixed releases from 21 October 2026 are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's advisory tells anyone on 8.1 or older to use a distribution or LTS vendor fix "or upgrade to a supported version." Researchers report the bugs reach back to PHP 5.4, so 7.4 is affected. For the complete branch table, see our PHP2Shell fixed versions guide.

The Official 7.4 Source Backport

The PHP security team's backports cover "PHP 7.4, PHP 8.0, and PHP 8.1," intended for "people building from source or without access to an LTS vendor." The 7.4 fix is the PHP-7.4-CVE-2026-109618-109619 branch, a single commit on 18 October 2026 labeled "Minimal mitigation for EOL version."

• It is source code only, with no release or binary.
• A build from it still reports PHP 7.4.33, the same as an unpatched build.
• It is a minimal fix for these two flaws only. The PHP project has released no other 7.4 fixes since 7.4.33 in November 2022.

That last point matters. A patched 7.4 is protected against PHP2Shell, but it has had no upstream fixes for anything else in nearly four years. Vendors such as Red Hat and Freexian may have fixed other 7.4 bugs in their own packages, but only your vendor can tell you which.

You may see unofficial PHP2Shell patch scripts for 7.4 shared online. Do not run them. They are not reviewed by the PHP project, and security firms have warned that some PHP2Shell repositories on GitHub are fake. Use the official branch or a vendor package.

Ubuntu 20.04 and Debian 11: The Fix Costs Money Now

Both of these long-lived distributions ship PHP 7.4 as their default PHP, and both are past their free support windows.

Ubuntu 20.04 LTS

Ubuntu's notice lists the 20.04 fix as "Fixed in 7.4.3-4ubuntu2.29+esm5" with "Fix available with Ubuntu Pro." Standard support for 20.04 ended in May 2025, and Ubuntu Pro extends it to May 2030. Canonical says Ubuntu Pro is "free for personal use on up to 5 physical machines"; business servers outside that allowance need a paid subscription. With Pro attached, Ubuntu documents sudo pro fix CVE-YYYY-XXXX (replace with the CVE ID) or a normal sudo apt update && sudo apt upgrade. Then restart PHP, for example sudo systemctl restart php7.4-fpm, or apache2 if you use mod_php.

Debian 11 bullseye

Debian 11's regular security archive has no PHP2Shell fix for php7.4. Freexian's tracker still lists the bullseye security package as vulnerable. The fix is in Freexian's Extended LTS advisory ELA-1853-1, published 21 October, version 7.4.33-1+deb11u14. Extended LTS is a paid service.

On either system, a version-number check will not help. Compare the full package version, or read the package changelog for the CVE IDs.

Other Sources of PHP 7.4, and Their Status

Several managed hosts also say they patched or mitigated 7.4 for customers. If you are on shared or managed hosting, ask your host whether your site runs a backported 7.4 build or only sits behind mitigations, and how to confirm it. Our guide on how to check your PHP version covers build dates and changelogs.

WordPress, Joomla and Drupal on PHP 7.4

WordPress is the main reason 7.4 survives. WordPress's core handbook says "WordPress requires PHP 7.4 or higher," and WordPress 7.0 dropped support for 7.2 and 7.3. So 7.4 is the lowest PHP a current WordPress will run on. Minimum does not mean safe, though. In its 21 October post on the PHP security release, WordPress.org said PHP versions before 8.2 no longer get security updates from the PHP project, and that self-hosters on them "should consider taking your server offline while you prepare to update to a newer version of PHP." WordPress recommends PHP 8.3 or greater. See our PHP2Shell guide for WordPress and our guide to WordPress PHP versions.

Joomla 4 runs on PHP 7.2.5 or later, with 8.2 recommended. Joomla 5 needs 8.1 and Joomla 6 needs 8.3, so a Joomla site on 7.4 is on Joomla 4 or older.

Drupal 10 requires at least PHP 8.1, so a Drupal site on 7.4 is running an older, unsupported Drupal major version.

None of these platforms had the PHP2Shell bug. It is in PHP, so no CMS or plugin update fixes it.

What Breaks When You Move From 7.4 to PHP 8

PHP 8.0 was a major version, and its migration guide is long. These changes cause most of the trouble on older sites:

After 8.0 come the 8.1, 8.2 and 8.3 changes: $GLOBALS write restrictions and resources turning into objects in 8.1, deprecated dynamic properties and utf8_encode() in 8.2, and Date exceptions in 8.3. Aim for PHP 8.3 or 8.4, not 8.2, which reaches end of life on 31 December 2026.

For a WordPress site with current plugins and theme, the jump often goes smoothly, because popular extensions have supported PHP 8 for years. Abandoned plugins and custom code are where it fails. Our plan for upgrading an old PHP site safely explains how to find those before your visitors do.

Your Options, in Order

1. Upgrade to PHP 8.3 or 8.4 (preferred). Back up, build a staging copy (our guide to WordPress staging sites shows how), update the CMS and every extension, switch PHP on staging, fix what breaks, then switch live. This ends the problem instead of postponing it.
2. Use a vendor-patched 7.4 as a stopgap. If your PHP comes from RHEL 8, AlmaLinux, Rocky, cPanel, Plesk or CloudLinux, install the fix and restart PHP now. On Ubuntu 20.04, attach Ubuntu Pro. On Debian 11, the options are Freexian's paid services. Treat this as weeks or months of breathing room, not a destination.
3. Isolate or take the site offline. If your 7.4 has no fix available, as with the Docker 7.4 image, and you cannot upgrade quickly, follow CISA. Its alert says organizations on "PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated." EU agencies advise isolating exposed applications from public networks.

While you work, PHP's interim mitigations reduce exposure but do not make a server safe. If you take a site down, use a maintenance page or a network restriction rather than disabling PHP, which can expose source code and credentials.

Containers on PHP 7.4

The official php:7.4 and php:7.4-apache tags were last pushed in November 2022 and will not get the fix. Rebuilding an image FROM php:7.4 produces the same vulnerable PHP. The only fix inside the official image family is to move the base to a maintained tag (8.2 or newer), test the application and redeploy. Other image publishers may have patched 7.4 images; check each publisher's own notes.

Conclusion

As of 23 October 2026, PHP 7.4 has no official PHP2Shell release, and on Ubuntu 20.04 and Debian 11 the vendor fix requires paid or extended support. RHEL 8, cPanel, Plesk and CloudLinux users can patch today. Everyone on 7.4 should plan the move to PHP 8.3 or 8.4, because the patched builds lack years of other upstream fixes and the upgrade only gets harder. If you need help patching now or testing the upgrade, our emergency PHP patching team can step in. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions