Skip to content
NoticeAWS reports broad exploitation attempts against php2shell in the wild (update of 22 Oct). If your PHP is not on a fixed version, update now.Details
Critical CVE-2026-109618 · CVE-2026-109619/ CVSS 9.2 / Disclosed 2026-10-21 Last updated
php2shellcheck
EN
EnglishEN 日本語JA DeutschDE FrançaisFR NederlandsNL
Get help
Menu

Changelog

Each time a vendor record, the checker or a guide changes, it is listed here.

  1. AWS updated its php2shell post: it now says it is seeing broad exploitation attempts in the wild (on 21 Oct it said 'being broadly exploited'). It still says it is unclear whether any of these attempts succeeded on real systems. Source
  2. DreamHost says the official PHP security updates have now been applied across its entire network. It has not said whether the fixes it promised for PHP 8.1 and older (PHP Extended Support) were delivered, so we still list it as rolling out. Source
  3. A2 Hosting closed its PHP update incident, saying the PHP-related service update has been completed successfully. The closing note names no CVE or PHP versions, so we still list it as rolling out. Source
  4. CERT.LV, Latvia's national CERT, says automated attempts to exploit the PHP vulnerabilities have been detected in Latvia, with no reports of successful attacks so far. Source
  5. Alpine 3.22 published fixed PHP packages in its community repository: php84 8.4.27-r0, php83 8.3.36-r0 and php82 8.2.35-r0, although that repository is past its end-of-support date. Source
  6. Oracle published fixed PHP modules for Oracle Linux 9: php:8.3 in ELSA-2026-87079 (8.3.36-1.module+el9.8.0+91082+c865dc1a) and php:8.2 in ELSA-2026-87072 (8.2.35-1.module+el9.8.0+91079+4ad1bd7f). Source
  7. AlmaLinux published fixed PHP packages: AlmaLinux 10 php 8.3.36-1.el10_2 (ALSA-2026:87070) and php8.4 8.4.27-1.el10_2 (ALSA-2026:87071), AlmaLinux 9 php:8.3 (ALSA-2026:87079) and AlmaLinux 8 php:7.4 (ALSA-2026:87080). Its AlmaLinux 9 php:8.2 advisory lists no php package build, so that stream stays unconfirmed. Source
  8. GoDaddy says all PHP versions on Web Hosting are now patched, so Web Hosting, Managed Hosting for WordPress and Windows Hosting need no customer action. VPS owners still update PHP themselves. Source
  9. Namecheap says its PHP maintenance on shared hosting servers has finished and marked its notice resolved. VPS and dedicated server owners update PHP themselves. Source
  10. Nexcess says most affected hosts are now patched and patching is underway on the rest. Source
  11. Rocky Linux published RLSA-2026:87073 with a fixed php:8.2 package for Rocky Linux 8: 8.2.35-1.module+el8.10.0+40394+d21b33fb. Source
  12. Oracle published fixed PHP modules for Oracle Linux 8: php:8.2 in ELSA-2026-87073 (8.2.35-1.module+el8.10.0+91081+33b5c645) and php:7.4 in ELSA-2026-87080 (7.4.33-8.module+el8.10.0+91080+9785160d). Source
  13. Alpine now lists fixed php packages in the repository index for Alpine 3.23 (php85 8.5.12-r0, php84 8.4.27-r0, php83 8.3.36-r0) and Alpine 3.21 (php82 8.2.35-r0). Source
  14. AWS says Elastic Beanstalk Amazon Linux 2023 PHP platform version 4.13.13 now ships PHP 8.3.36 and PHP 8.2.35, after PHP 8.5.12 and 8.4.27 on 21 Oct. Environments need a platform update unless Managed Platform Updates is on. Source
  15. Hostinger says PHP upgrades are now complete across all managed hosting servers (22 Oct, 06:44 UTC). VPS customers manage PHP themselves. Source
  16. IONOS says it has rolled out the official PHP updates across all platforms it operates itself (incident resolved 22 Oct, 10:10 UTC). Owners of a VPS or dedicated server must update PHP themselves. Source
  17. Infomaniak says the PHP security fixes are deployed on its entire shared Web Hosting and Cloud Server infrastructure for PHP 8.5, 8.4, 8.3, 8.2, 8.1, 8.0 and 7.4. Source
  18. Kinsta says all sites are protected and the PHP security updates have been rolled out across the platform (incident resolved 22 Oct, 08:26 UTC). Source
  19. ConoHa says in its final report that the security patches are applied to ConoHa WING servers (status as of 20:45 JST on 22 Oct) and customers do not need to change their PHP version. Source
  20. Value Domain's notices now say the fix is complete for every PHP version offered on CORESERVER V1 (5.3 to 8.5), CORESERVER V2 (5.2 to 8.5), XREA and VALUESERVER (5.3 to 8.5 each) and One Rental Server (5.6 to 8.5). Source
  21. Xserver says on its official X account that fix patches are applied on all target servers for PHP 5.6 to 8.5, and that patches for PHP 5.5 and older are still being created and verified. Source
  22. KAGOYA says it is updating Rental Server plans to the fixed PHP versions in sequence and expects to finish at 24:00 JST on 22 Oct. Source
  23. A2 Hosting says it is rolling out the upstream PHP security patches on its cPanel/Plesk and Enhance platforms; self-managed server owners must apply the vendor updates themselves. Source
  24. AWS (Amazon Threat Intelligence) says php2shell is now being broadly exploited in the wild, and that its honeypot sensors recorded an exploitation attempt dated 17 Oct, four days before disclosure. AWS adds that it is unclear whether those attempts succeeded on real systems. CISA's KEV catalog does not list either CVE as of 22 Oct. Source
  25. Amazon published a fixed php8.5 package for the Amazon Linux 2027 Preview: 8.5.12-1.amzn2027.0.1 (ALAS2027-2026-243). Source
  26. Hostnet says the PHP security update is rolled out on all of its systems, including older PHP versions via PHP Extended Support, and has lifted its temporary measures. Source
  27. Hetzner says it has also deployed patches for PHP 5.6 and 7.3 on all Webhosting and Managed Servers, after PHP 7.4 and 8.0 to 8.5. Source
  28. Upsun says the PHP security patch has finished deploying to all Dedicated clusters, after updated images reached all grid regions. Source
  29. CPI says it is urgently applying the latest PHP patches on the versions that have one, and will post an update on versions without a patch. Source
  30. Red Hat's CVE pages now list fixed packages. RHEL 10: php 8.3.36-1.el10_2 (RHSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RHSA-2026:87071). RHEL 9: php 8.0.30-8.el9_8.1 (RHSA-2026:87151), php:8.2 (RHSA-2026:87072) and php:8.3 (RHSA-2026:87079). RHEL 8: php:8.2 (RHSA-2026:87073), after php:7.4 (RHSA-2026:87080). RHEL 9 php:8.4 is still listed as Affected with no advisory, and RHEL 7 as 'Under investigation' for CVE-2026-109618 and 'Not affected' for CVE-2026-109619. Source
  31. Rocky Linux published fixed PHP packages. Rocky Linux 10: php 8.3.36-1.el10_2 (RLSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RLSA-2026:87071). Rocky Linux 9: php 8.0.30-8.el9_8.1 (RLSA-2026:87151), php:8.2 (RLSA-2026:87072) and php:8.3 (RLSA-2026:87079). Rocky Linux 8: php:7.4 (RLSA-2026:87080). There is no advisory yet for Rocky Linux 9 php:8.4 or Rocky Linux 8 php:8.2. Source
  32. Oracle's CVE pages list errata for Oracle Linux 10 (ELSA-2026-87070 php 8.3.36-1.el10_2 and ELSA-2026-87071 php8.4 8.4.27-1.el10_2) and Oracle Linux 9 (ELSA-2026-87151 php 8.0.30-8.el9_8.1). They list no php module stream for Oracle Linux 9 and no entry yet for Oracle Linux 8. Source
  33. Amazon Linux 2023: ALAS2023-2026-3301 to ALAS2023-2026-3304 list fixed packages for php8.2 (8.2.35-1.amzn2023.0.1), php8.3 (8.3.36-1.amzn2023.0.1), php8.4 (8.4.27-1.amzn2023.0.1) and php8.5 (8.5.12-1.amzn2023.0.1). Source
  34. Amazon Linux 2: ALAS2PHP8.2-2026-015 lists the fixed php 8.2.35-1.amzn2.0.1 packages for the amazon-linux-extras php8.2 stream. Source
  35. Amazon's CVE pages list php8.1 on Amazon Linux 2023 and the Amazon Linux 2 core php package as 'No Fix Planned'; no fixed package is shown for either. Source
  36. Alpine edge: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community package index. Not every architecture is updated yet (x86, ppc64le, s390x and riscv64 still listed older builds at our check). Source
  37. Debian's security tracker lists php8.4 8.4.27-1 as the fix in unstable (sid) for both CVEs. Testing (forky) still has php8.4 8.4.26-1, which the tracker marks vulnerable. Source
  38. Debian 11 (bullseye): Debian itself has no php7.4 entry for these CVEs because Long Term Support ended on 31 August 2026. Freexian's paid Extended LTS service lists 7.4.33-1+deb11u14 (ELA-1853-1), available only to its subscribers. Source
  39. Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 10, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. Source
  40. Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 9, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. Source
  41. Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 8, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. Source
  42. JVN (JPCERT/CC and IPA) published vulnerability note JVNVU#99905564 for both CVEs. It points to the PHP Group advisory and does not name fixed versions itself. Source
  43. The Canadian Centre for Cyber Security published alert AL26-026 listing the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says a proof of concept is reported in open sources and that it has identified no active exploitation at this time. Source
  44. The PHP Foundation says proof-of-concept code circulated more widely on 21 October, and that its security team did not identify any functional exploits at the time of release. Source
  45. GoDaddy says Managed Hosting for WordPress is fully patched and needs no action. Web Hosting and Windows Hosting are mitigated while it waits for patched packages from its vendor, and VPS owners must update PHP themselves. Source
  46. WP Engine says it has finished deploying the PHP security patches on its platform and no action is needed (updated builds named: 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12). Source
  47. Cloudways says patches are applied for all customer applications on its Autonomous product and are still rolling out for applications on Flexible. Source
  48. Liquid Web published its patched build numbers (cPanel PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Plesk v18.0.81.4) and says patched builds are still being deployed across its infrastructure. Customers who are not patched yet should run a package update in their control panel. Source
  49. DigitalOcean says the App Platform PHP buildpack is patched. You must redeploy your app to pick it up, and apps built from your own Dockerfile or image need PHP updated in that image. Source
  50. AWS Elastic Beanstalk released Amazon Linux 2023 PHP 8.5 and PHP 8.4 platform versions (4.13.13) with PHP 8.5.12 and 8.4.27. A later release is to update the PHP 8.3 and PHP 8.2 platform branches. Source
  51. AWS published Lightsail guidance for updating PHP yourself. Instances from Lightsail-packaged blueprints update PHP with the package manager; Bitnami-blueprint instances keep their own copy of PHP that apt upgrade does not update. AWS lists the fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Source
  52. netcup says all Webhosting packages (including Reseller) and all Managed Servers are patched and online. Root server, VPS and managed cloud cluster customers must patch PHP themselves. Source
  53. CloudLinux says its release of fixed alt-php packages is complete (22 October, 00:07 UTC) and a regular update installs them, followed by a PHP restart. The packages carry the fix as a backport and keep their own lower version numbers, so check the package changelog. Source
  54. Plesk says its own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4, and asks customers to update Plesk to the latest available version. Source
  55. aaPanel now says patches are available in its App Store for PHP 7.4 to 8.5; update each installed PHP version there. Users on PHP 7.3 or older are pointed to configuration mitigation only. Source
  56. Sakura Internet says the fix is complete for every PHP version selectable in the Rental Server and Managed Server control panel. phpMyAdmin and webmail used by some services are still being handled. Source
  57. GMO Pepabo says on its official X account that Lolipop has the fixed version applied and customer sites were restored at 13:11 JST on 22 October. It also applied its own fixes to older PHP versions that have no official fix. Source
  58. GMO Pepabo says heteml has the official fixed versions for the PHP 8 series and PHP 7.4, and its own fix for all other versions. Some functions are disabled on PHP 8.1 and below. Source
  59. ColorfulBox says the security fix is complete on all its servers as of the morning of 22 October, and customers do not need to change their PHP version. Source
  60. mixhost says it finished applying the PHP fix packages on all its rental servers at about 10:18 JST on 22 October (PHP 5.2 to 8.5). The PHP version number shown does not change, and no customer action is needed. Source
  61. ConoHa says it is applying security patches to ConoHa WING servers in sequence and keeping each customer's current PHP version. Source
  62. GMO Internet says it is applying security patches to Onamae.com Rental Server servers in sequence and keeping each customer's current PHP version. A change may be needed for some customers on PHP 5.x or 7.x. Source
  63. Value Domain's status page says the fix is complete on CORESERVER V2 for every PHP version it offers, and on CORESERVER V1 for PHP 7.4 and later. Older PHP versions on V1 are not mentioned. Source
  64. Value Domain's status page says the fix is complete on XREA for PHP 7.4 and later. Older PHP versions are not mentioned. Source
  65. Value Domain's status page says the fix is complete on VALUESERVER for PHP 7.4 and later. Older PHP versions are not mentioned. Source
  66. Value Domain's status page says the fix is complete on One Rental Server for PHP 8.0 and later. Older PHP versions are not mentioned. Source
  67. NTTPC published a notice for WebARENA SuiteX naming both CVEs. Web access from outside Japan is restricted and one PHP function (file-upload progress) is disabled as mitigations; the notice does not say a PHP fix has been applied. Source
  68. Red Hat released RHSA-2026:87080 for RHEL 8 php:7.4 (7.4.33-8.module+el8.10.0+25117+30337cca), which fixes both CVEs. Source
  69. Alpine 3.24: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community repository. On Alpine edge, php83 8.3.36-r0 is listed in the security database but the package is not in the repository yet. Source
  70. Homebrew: php is now 8.5.12, php@8.4 is 8.4.27, php@8.3 is 8.3.36 and php@8.2 is 8.2.35. Source
  71. NVD added its own CVSS 3.1 score of 9.8 (Critical) for both CVEs, and its affected-version data now also covers PHP versions older than 8.2.35. Source
  72. Laravel Cloud says every running application is now patched (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35). Source
  73. Hetzner says PHP 7.4 and 8.0 to 8.5 are patched on all Webhosting and Managed Servers. Source
  74. OVHcloud says PHP 7.4 to 8.5 are patched on all Web Hosting clusters. Source
  75. Flywheel says patching of its platform is finished and no customer action is needed. Source
  76. Azure App Service finished rolling out patched PHP images to the Latest and Standard channels (8.2.35, 8.3.36, 8.4.27, 8.5.12). Source
  77. Plesk now has PHP 8.2 to 8.5 fixes for Windows too, and says rebuilt 7.4, 8.0 and 8.1 packages on Linux include the fix. Source
  78. DirectAdmin released a further build with patches for PHP 7.3 down to 5.6. Source
  79. CloudLinux released more fixed alt-php builds (alt-php74, alt-php80 and alt-php81 on more platforms); other versions are still in preparation. Source
  80. Webuzo published patched EMPS packages and tells users to run the EMPS update command. CyberPanel says fixed LiteSpeed PHP packages (8.2.35, 8.3.36, 8.4.27, 8.5.12) are available and administrators must update. Source
  81. Hosting status: Hostinger, Kinsta, Upsun and Infomaniak now report that patched PHP is being rolled out.
  82. Hosting status: new progress updates from Namecheap, Pantheon, netcup, Xserver, Liquid Web, WP Engine, Cloudways, Wordfence and Virtualmin.
  83. Site launched with the version checker, the fixed-version table for Linux distributions, Docker and other platforms, and the hosting status table.
  84. Debian's security tracker lists fixed php8.4 packages for Debian 13 (DSA-6574-1) and php8.2 packages for Debian 12 (DLA-4848-1). Source
  85. The official Docker php images were rebuilt with PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Source
  86. Ubuntu published USN-8948-1 and USN-8948-2 with fixed PHP packages (Ubuntu 20.04 and older through Ubuntu Pro). Source
  87. php.net released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619. Source