PHP2Shell Response Kit
Reference

PHP2Shell: affected and fixed versions

Which releases carry the fix, which are still exposed, and why a distribution backport, a container digest or an appliance firmware build can look different from the upstream number.

Reviewed 30 October 2026 Scope PHP 8.2–8.5 and vendor builds Official sources

Short answer

Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 on the branch you already run. Every earlier release on those branches is exposed to CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and older are end of life and receive no upstream fix; some distributions provide backports, and PHP published minimal source backports for 7.4, 8.0 and 8.1.

A version string is not proof. A backported package can keep the old upstream number, a container can run an old image under a current tag, and an appliance is patched by firmware, not by the PHP package you see on a server.

Upstream releases

Upstream fixed releases, checked 30 October 2026
Branch Still exposed Fixed release Released Support after the fix
PHP 8.2 Any 8.2.x before 8.2.35 8.2.35 21 October 2026 Security fixes only until 31 Dec 2026
PHP 8.3 Any 8.3.x before 8.3.36 8.3.36 21 October 2026 Security fixes only until 31 Dec 2027
PHP 8.4 Any 8.4.x before 8.4.27 8.4.27 21 October 2026 Active support until 31 Dec 2026, security until 31 Dec 2028
PHP 8.5 Any 8.5.x before 8.5.12 8.5.12 21 October 2026 Active support until 31 Dec 2027, security until 31 Dec 2029

PHP 8.2 leaves security support on 31 December 2026. A patch now does not extend that date.

Advisory and release dates

Reference dates for the fixes and the exploitation listings. This is not an incident timeline; the site does not publish event coverage.

Dates recorded in the sources for this page
Date What it records
21 October 2026 PHP publishes the fixed releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and the security advisory for both critical CVEs.
23 October 2026 PHP publishes the informational session upload progress advisory (CVE-2026-115560). The fixed releases do not change.
26 October 2026 CISA adds CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog, with a 29 October due date for US federal civilian agencies.
28 October 2026 CISA adds CVE-2026-46300 (Linux kernel, Fragnesia), describing it as chainable with both PHP2Shell CVEs to implant webshells and run commands as root.
29 October 2026 Unit 42 states that it independently verified the PAN-OS firewall chain and identifies the affected product.

Distribution and runtime packages

Check the fixed package for your release and architecture, not the upstream number alone. The table records what each publisher states and how far this kit verified it.

Platform status, checked 30 October 2026
Platform Status What counts as evidence
PHP upstream source / Windows builds Confirmed Upstream fixes: 8.2.35, 8.3.36, 8.4.27, 8.5.12.
Ubuntu 22.04 / 24.04 / 26.04 / 26.10 Confirmed Fixed packages published. Examples: 24.04 php8.3 8.3.6-0ubuntu0.24.04.13; 22.04 php8.1 8.1.2-1ubuntu2.28. Other releases require Ubuntu Pro/ESM.
Debian 12 bookworm / Debian 13 trixie Confirmed Fixed via DLA-4848-1 (php8.2 8.2.35-1~deb12u1) and DSA-6574-1 (php8.4 8.4.27-1~deb13u1). Forky was listed as vulnerable when checked.
Official php Docker image Confirmed Tags for 8.2.35, 8.3.36, 8.4.27 and 8.5.12 exist in the official version feed. A running container must be checked by image digest.
Red Hat Enterprise Linux Limited Red Hat rates the issue Important and notes that RHEL commonly uses FPM. No product impact table or fixed errata was visible on the CVE page when checked. Confirm against the actual RHEL minor release and repositories.
Managed hosting providers Not verified No provider-specific package or restart confirmation was verified for this kit. Treat the provider's written response, including an exact version and restart statement, as the evidence to obtain.
WordPress Not verified WordPress does not patch PHP. The runtime version is set by the host or the server image. WordPress guidance covers compatibility testing, not a PHP2Shell fix.
Alpine Linux Not verified No stable package page could be retrieved at the time of writing. Check Alpine's security tracker and the exact repository branch before recording a fix.

Vendor builds to check separately

These products embed PHP. The fix is a vendor build, so a fixed PHP package on a server says nothing about them.

Vendor fixed builds, checked 30 October 2026
Product What is affected Fixed builds
Palo Alto Networks PAN-OS and Panorama Management web interface only: the HTTPS UI and XML API. No special configuration is required to be affected. Hotfixes per branch, for example 12.2.4-h1, 12.1.7-h11, 11.2.16-h1 or 10.2.18-h13. Use the advisory for your branch. Unit 42 reports active exploitation against internet-facing management interfaces and has verified the chained intrusion.
Citrix NetScaler ADC and Gateway NetScaler ADC and Gateway releases; other Citrix products listed in the advisory are not impacted. 14.1-73.49 and later, 13.1-64.32 and later, with corresponding FIPS and NDcPP builds. Citrix does not report exploitation in its advisory.
QNAP QTS and QuTS QTS, QuTS hero, QuTScloud, Note Station and QVR on the listed versions. QTS 6.1.0.3656 and 5.2.11.3661; QuTS hero h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661; QuTScloud c5.2.9.3661, all build 20261023. QNE (ADRA) was still marked fixing. PHP inside Container Station images is outside the firmware fix.

How to read a version string

  • Distribution backports keep their own number. Ubuntu and Debian publish a package revision such as 8.3.6-0ubuntu0.24.04.13; the upstream number can stay behind while the fix is present.
  • A container tag is not a digest. A running container must be checked by image digest, and a rebuilt image must be replaced, not restarted in place.
  • CLI and web SAPI differ. php -v describes the CLI binary. Record the version of the process that answers HTTP, then confirm it with process start times.
  • Appliance firmware is the unit. Record the firmware or hotfix build, the restart, and the vendor advisory that names it.

What to do next

Assess your inventory Find every runtime that answers HTTP, including the ones without an owner. Patch from the right source Choose the fixed release for your branch and restart every worker. Verify what is running Package, process, traffic and business evidence — in that order.

Sources

Every claim on this page maps to one of these records; the full record, including what each source does not establish, is on the sources page.