Skip to content
NoticeAWS reports broad exploitation attempts against php2shell in the wild (update of 22 Oct). If your PHP is not on a fixed version, update now.Details
Critical CVE-2026-109618 · CVE-2026-109619/ CVSS 9.2 / Disclosed 2026-10-21 Last updated

Fixed PHP versions by distribution

Every row links to the vendor's own advisory. A distribution package can be fixed with a version number that looks older than the upstream one, because vendors back-port fixes.

Last updated:

Upstream PHP

ReleaseFixed versionAdvisoryLast checked
PHP 8.5
8.5.12
2026-10-22 23:17 UTC
PHP 8.4
8.4.27
2026-10-22 23:17 UTC
PHP 8.3
8.3.36
2026-10-22 23:17 UTC
PHP 8.2
8.2.35
2026-10-22 23:17 UTC

Ubuntu

26.10 (stonking)

PackageFixed versionStatusAdvisoryLast checked
php8.5 (PHP 8.5)
8.5.9-0ubuntu2.1
Fixed
2026-10-22 23:17 UTC

26.04 LTS (resolute)

PackageFixed versionStatusAdvisoryLast checked
php8.5 (PHP 8.5)
8.5.4-0ubuntu1.5
Fixed
2026-10-22 23:17 UTC

25.10 (questing)

PackageFixed versionStatusAdvisoryLast checked
php
not published
End of life
2026-10-22 23:17 UTC

25.04 (plucky)

PackageFixed versionStatusAdvisoryLast checked
php
not published
End of life
2026-10-22 23:17 UTC

24.04 LTS (noble)

PackageFixed versionStatusAdvisoryLast checked
php8.3 (PHP 8.3)
8.3.6-0ubuntu0.24.04.13
Fixed
2026-10-22 23:17 UTC

22.04 LTS (jammy)

PackageFixed versionStatusAdvisoryLast checked
php8.1 (PHP 8.1)
8.1.2-1ubuntu2.28
Fixed
2026-10-22 23:17 UTC

20.04 LTS (focal)

PackageFixed versionStatusAdvisoryLast checked
php7.4 (PHP 7.4)
7.4.3-4ubuntu2.29+esm5
Fixed
Requires Ubuntu Pro
2026-10-22 23:17 UTC

18.04 LTS (bionic)

PackageFixed versionStatusAdvisoryLast checked
php7.2 (PHP 7.2)
7.2.24-0ubuntu0.18.04.17+esm14
Fixed
Requires Ubuntu Pro
2026-10-22 23:17 UTC

16.04 LTS (xenial)

PackageFixed versionStatusAdvisoryLast checked
php7.0 (PHP 7.0)
7.0.33-0ubuntu0.16.04.16+esm22
Fixed
Requires Ubuntu Pro (Legacy Support add-on)
2026-10-22 23:17 UTC

14.04 LTS (trusty)

PackageFixed versionStatusAdvisoryLast checked
php5 (PHP 5.5)
5.5.9+dfsg-1ubuntu4.29+esm18
Fixed
Requires Ubuntu Pro (Legacy Support add-on)
2026-10-22 23:17 UTC

Debian

13 (trixie) security

PackageFixed versionStatusAdvisoryLast checked
php8.4 (PHP 8.4)
8.4.27-1~deb13u1
Fixed
2026-10-22 23:17 UTC

12 (bookworm) security (LTS team)

PackageFixed versionStatusAdvisoryLast checked
php8.2 (PHP 8.2)
8.2.35-1~deb12u1
Fixed
2026-10-22 23:17 UTC

11 (bullseye) ELTS (Freexian Extended LTS)

PackageFixed versionStatusAdvisoryLast checked
php7.4 (PHP 7.4)
not published
Unconfirmed
2026-10-22 23:17 UTC

forky (testing)

PackageFixed versionStatusAdvisoryLast checked
php8.4 (PHP 8.4)
not published
No fix yet
2026-10-22 23:17 UTC

sid (unstable)

PackageFixed versionStatusAdvisoryLast checked
php8.4 (PHP 8.4)
8.4.27-1
Fixed
2026-10-22 23:17 UTC

Red Hat Enterprise Linux

Red Hat Enterprise Linux 10

PackageFixed versionStatusAdvisoryLast checked
php
not published
Unconfirmed
2026-10-22 23:17 UTC
php8.4 (PHP 8.4)
8.4.27-1.el10_2
Fixed
2026-10-22 23:17 UTC
php (PHP 8.3)
8.3.36-1.el10_2
Fixed
2026-10-22 23:17 UTC

Red Hat Enterprise Linux 9

PackageFixed versionStatusAdvisoryLast checked
php
not published
Unconfirmed
2026-10-22 23:17 UTC
php:8.4/php (PHP 8.4)
not published
No fix yet
2026-10-22 23:17 UTC
php:8.3/php (PHP 8.3)
8.3.36-1.module+el9.8.0+25109+6886e21a
Fixed
2026-10-22 23:17 UTC
php:8.2/php (PHP 8.2)
8.2.35-1.module+el9.8.0+25111+a1450321
Fixed
2026-10-22 23:17 UTC
php (PHP 8.0)
8.0.30-8.el9_8.1
Fixed
2026-10-22 23:17 UTC

Red Hat Enterprise Linux 8

PackageFixed versionStatusAdvisoryLast checked
php:8.2/php (PHP 8.2)
8.2.35-1.module+el8.10.0+25110+f67151d2
Fixed
2026-10-22 23:17 UTC
php:7.4/php (PHP 7.4)
7.4.33-8.module+el8.10.0+25117+30337cca
Fixed
2026-10-22 23:17 UTC

Red Hat Enterprise Linux 7

PackageFixed versionStatusAdvisoryLast checked
php
not published
No fix yet
2026-10-22 23:17 UTC

Red Hat Enterprise Linux 6

PackageFixed versionStatusAdvisoryLast checked
php
not published
No fix yet
2026-10-22 23:17 UTC

AlmaLinux

AlmaLinux 10

PackageFixed versionStatusAdvisoryLast checked
php (AppStream)
not published
Unconfirmed
2026-10-22 23:17 UTC
php8.4 (AppStream) (PHP 8.4)
8.4.27-1.el10_2
Fixed
2026-10-22 23:17 UTC
php (AppStream) (PHP 8.3)
8.3.36-1.el10_2
Fixed
2026-10-22 23:17 UTC

AlmaLinux 9

PackageFixed versionStatusAdvisoryLast checked
php (AppStream)
not published
Unconfirmed
2026-10-22 23:17 UTC
php:8.3/php (PHP 8.3)
8.3.36-1.module_el9.8.0+330+fdc30075
Fixed
2026-10-22 23:17 UTC

AlmaLinux 8

PackageFixed versionStatusAdvisoryLast checked
php (AppStream)
not published
Unconfirmed
2026-10-22 23:17 UTC
php:7.4/php (PHP 7.4)
7.4.33-8.module_el8.10.0+4321+cf5fd4bb
Fixed
2026-10-22 23:17 UTC

Rocky Linux

Rocky Linux 10

PackageFixed versionStatusAdvisoryLast checked
php (AppStream)
not published
Unconfirmed
2026-10-22 23:17 UTC
php8.4 (AppStream) (PHP 8.4)
8.4.27-1.el10_2
Fixed
2026-10-22 23:17 UTC
php (AppStream) (PHP 8.3)
8.3.36-1.el10_2
Fixed
2026-10-22 23:17 UTC

Rocky Linux 9

PackageFixed versionStatusAdvisoryLast checked
php (AppStream)
not published
Unconfirmed
2026-10-22 23:17 UTC
php:8.4/php (PHP 8.4)
not published
Unconfirmed
2026-10-22 23:17 UTC
php:8.3/php (PHP 8.3)
8.3.36-1.module+el9.8.0+40396+4e680bb7
Fixed
2026-10-22 23:17 UTC
php:8.2/php (PHP 8.2)
8.2.35-1.module+el9.8.0+40395+2f706e64
Fixed
2026-10-22 23:17 UTC
php (AppStream) (PHP 8.0)
8.0.30-8.el9_8.1
Fixed
2026-10-22 23:17 UTC

Rocky Linux 8

PackageFixed versionStatusAdvisoryLast checked
php (AppStream)
not published
Unconfirmed
2026-10-22 23:17 UTC
php:8.2/php (PHP 8.2)
8.2.35-1.module+el8.10.0+40394+d21b33fb
Fixed
2026-10-22 23:17 UTC
php:7.4/php (PHP 7.4)
7.4.33-8.module+el8.10.0+40393+c071e357
Fixed
2026-10-22 23:17 UTC

Oracle Linux

Oracle Linux 10

PackageFixed versionStatusAdvisoryLast checked
php
not published
Unconfirmed
2026-10-22 23:17 UTC
php8.4 (PHP 8.4)
8.4.27-1.el10_2
Fixed
2026-10-22 23:17 UTC
php (PHP 8.3)
8.3.36-1.el10_2
Fixed
2026-10-22 23:17 UTC

Oracle Linux 9

PackageFixed versionStatusAdvisoryLast checked
php
not published
Unconfirmed
2026-10-22 23:17 UTC
php (PHP 8.0)
8.0.30-8.el9_8.1
Fixed
2026-10-22 23:17 UTC
php:8.3/php (PHP 8.3)
8.3.36-1.module+el9.8.0+91082+c865dc1a
Fixed
2026-10-22 23:17 UTC
php:8.2/php (PHP 8.2)
8.2.35-1.module+el9.8.0+91079+4ad1bd7f
Fixed
2026-10-22 23:17 UTC

Oracle Linux 8

PackageFixed versionStatusAdvisoryLast checked
php
not published
Unconfirmed
2026-10-22 23:17 UTC
php:8.2/php (PHP 8.2)
8.2.35-1.module+el8.10.0+91081+33b5c645
Fixed
2026-10-22 23:17 UTC
php:7.4/php (PHP 7.4)
7.4.33-8.module+el8.10.0+91080+9785160d
Fixed
2026-10-22 23:17 UTC

Amazon Linux

Amazon Linux 2027 Preview

PackageFixed versionStatusAdvisoryLast checked
php8.5 (PHP 8.5)
8.5.12-1.amzn2027.0.1
Fixed
2026-10-22 23:17 UTC

Amazon Linux 2023

PackageFixed versionStatusAdvisoryLast checked
php8.5 (PHP 8.5)
8.5.12-1.amzn2023.0.1
Fixed
2026-10-22 23:17 UTC
php8.4 (PHP 8.4)
8.4.27-1.amzn2023.0.1
Fixed
2026-10-22 23:17 UTC
php8.3 (PHP 8.3)
8.3.36-1.amzn2023.0.1
Fixed
2026-10-22 23:17 UTC
php8.2 (PHP 8.2)
8.2.35-1.amzn2023.0.1
Fixed
2026-10-22 23:17 UTC
php8.1 (PHP 8.1)
not published
No fix yet
2026-10-22 23:17 UTC

Amazon Linux 2 (amazon-linux-extras php8.2)

PackageFixed versionStatusAdvisoryLast checked
php (amazon-linux-extras php8.2) (PHP 8.2)
8.2.35-1.amzn2.0.1
Fixed
2026-10-22 23:17 UTC
php (AL2 core repository)
not published
No fix yet
2026-10-22 23:17 UTC

Alpine Linux

edge (development)

PackageFixed versionStatusAdvisoryLast checked
php85 (PHP 8.5)
8.5.12-r0
Fixed
2026-10-22 23:17 UTC
php84 (PHP 8.4)
8.4.27-r0
Fixed
2026-10-22 23:17 UTC
php83 (PHP 8.3)
8.3.36-r0
Fixed
2026-10-22 23:17 UTC

Alpine 3.24

PackageFixed versionStatusAdvisoryLast checked
php85 (PHP 8.5)
8.5.12-r0
Fixed
2026-10-22 23:17 UTC
php84 (PHP 8.4)
8.4.27-r0
Fixed
2026-10-22 23:17 UTC
php83 (PHP 8.3)
8.3.36-r0
Fixed
2026-10-22 23:17 UTC

Alpine 3.23

PackageFixed versionStatusAdvisoryLast checked
php85 (PHP 8.5)
8.5.12-r0
Fixed
2026-10-22 23:17 UTC
php84 (PHP 8.4)
8.4.27-r0
Fixed
2026-10-22 23:17 UTC
php83 (PHP 8.3)
8.3.36-r0
Fixed
2026-10-22 23:17 UTC

Alpine 3.22

PackageFixed versionStatusAdvisoryLast checked
php84 (PHP 8.4)
8.4.27-r0
Fixed
2026-10-22 23:17 UTC
php83 (PHP 8.3)
8.3.36-r0
Fixed
2026-10-22 23:17 UTC
php82 (PHP 8.2)
8.2.35-r0
Fixed
2026-10-22 23:17 UTC

Alpine 3.21

PackageFixed versionStatusAdvisoryLast checked
php84 (PHP 8.4)
not published
End of life
2026-10-22 23:17 UTC
php83 (PHP 8.3)
not published
End of life
2026-10-22 23:17 UTC
php82 (PHP 8.2)
8.2.35-r0
Fixed
2026-10-22 23:17 UTC

Alpine 3.20

PackageFixed versionStatusAdvisoryLast checked
php83 (PHP 8.3)
not published
End of life
2026-10-22 23:17 UTC
php82 (PHP 8.2)
not published
End of life
2026-10-22 23:17 UTC

Alpine 3.19

PackageFixed versionStatusAdvisoryLast checked
php83 (PHP 8.3)
not published
End of life
2026-10-22 23:17 UTC
php82 (PHP 8.2)
not published
End of life
2026-10-22 23:17 UTC
php81 (PHP 8.1)
not published
End of life
2026-10-22 23:17 UTC

Docker (official php image)

Docker Official Image 'php'

PackageFixed versionStatusAdvisoryLast checked
php:8.5 (PHP 8.5)
8.5.12
Fixed
2026-10-22 23:17 UTC
php:8.4 (PHP 8.4)
8.4.27
Fixed
2026-10-22 23:17 UTC
php:8.3 (PHP 8.3)
8.3.36
Fixed
2026-10-22 23:17 UTC
php:8.2 (PHP 8.2)
8.2.35
Fixed
2026-10-22 23:17 UTC
php:8.1 (PHP 8.1)
not published
End of life
2026-10-22 23:17 UTC
php:8.0 (PHP 8.0)
not published
End of life
2026-10-22 23:17 UTC
php:7.4 (PHP 7.4)
not published
End of life
2026-10-22 23:17 UTC

Windows (windows.php.net)

Windows binaries (windows.php.net)

PackageFixed versionStatusAdvisoryLast checked
php-8.5.12-Win32-vs17-x64.zip (PHP 8.5)
8.5.12
Fixed
2026-10-22 23:17 UTC
php-8.4.27-Win32-vs17-x64.zip (PHP 8.4)
8.4.27
Fixed
2026-10-22 23:17 UTC
php-8.3.36-Win32-vs16-x64.zip (PHP 8.3)
8.3.36
Fixed
2026-10-22 23:17 UTC
php-8.2.35-Win32-vs16-x64.zip (PHP 8.2)
8.2.35
Fixed
2026-10-22 23:17 UTC
php-8.1.34-Win32 (latest listed) (PHP 8.1)
not published
End of life
2026-10-22 23:17 UTC
php-8.0.30-Win32 (latest listed) (PHP 8.0)
not published
End of life
2026-10-22 23:17 UTC
php-7.4.33-Win32 (latest listed) (PHP 7.4)
not published
End of life
2026-10-22 23:17 UTC

Homebrew

Homebrew formulae (macOS and Linux)

PackageFixed versionStatusAdvisoryLast checked
php (PHP 8.5)
8.5.12
Fixed
2026-10-22 23:17 UTC
php@8.4 (PHP 8.4)
8.4.27
Fixed
2026-10-22 23:17 UTC
php@8.3 (PHP 8.3)
8.3.36
Fixed
2026-10-22 23:17 UTC
php@8.2 (PHP 8.2)
8.2.35
Fixed
2026-10-22 23:17 UTC
php@8.1 (PHP 8.1)
not published
End of life
2026-10-22 23:17 UTC

XAMPP

XAMPP (Apache Friends) download page

PackageFixed versionStatusAdvisoryLast checked
XAMPP for Windows/Linux installers: PHP 8.0.30, 8.1.25, 8.2.12 (PHP 8.2)
not published
No fix yet
2026-10-22 23:17 UTC

Third-party repositories

These repositories are run by their own maintainers, not by the distribution vendor. Their fixed versions come from the repository's own changelog, not from a vendor security advisory.

ppa:ondrej/php for Ubuntu (third-party)

24.04 LTS (noble) - ppa:ondrej/php

PackageFixed versionStatusAdvisoryLast checked
php8.5 (PHP 8.5)
8.5.12-1+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.4 (PHP 8.4)
8.4.27-1+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.3 (PHP 8.3)
8.3.36-1+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.2 (PHP 8.2)
8.2.35-1+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.1 (PHP 8.1)
8.1.34-9+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.0 (PHP 8.0)
1:8.0.30-25+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.4 (PHP 7.4)
1:7.4.33-31+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.3 (PHP 7.3)
7.3.33-35+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.2 (PHP 7.2)
7.2.34-66+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php5.6 (PHP 5.6)
5.6.40-104+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.0 (PHP 7.0)
7.0.33-92+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.1 (PHP 7.1)
7.1.33-80+ubuntu24.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC

22.04 LTS (jammy) - ppa:ondrej/php

PackageFixed versionStatusAdvisoryLast checked
php8.5 (PHP 8.5)
8.5.12-1+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.4 (PHP 8.4)
8.4.27-1+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.3 (PHP 8.3)
8.3.36-1+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.2 (PHP 8.2)
8.2.35-1+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.1 (PHP 8.1)
8.1.34-9+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php8.0 (PHP 8.0)
1:8.0.30-25+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.4 (PHP 7.4)
1:7.4.33-31+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.3 (PHP 7.3)
7.3.33-35+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.2 (PHP 7.2)
7.2.34-66+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php5.6 (PHP 5.6)
5.6.40-104+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.0 (PHP 7.0)
7.0.33-92+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC
php7.1 (PHP 7.1)
7.1.33-80+ubuntu22.04.1+deb.sury.org+1
Fixed
2026-10-22 23:17 UTC

packages.sury.org for Debian (third-party)

PackageFixed versionStatusAdvisoryLast checked
php8.5 (PHP 8.5)
8.5.12-1
Fixed
2026-10-22 23:17 UTC
php8.4 (PHP 8.4)
8.4.27-1
Fixed
2026-10-22 23:17 UTC
php8.3 (PHP 8.3)
8.3.36-1
Fixed
2026-10-22 23:17 UTC
php8.2 (PHP 8.2)
8.2.35-1
Fixed
2026-10-22 23:17 UTC
php8.1 (PHP 8.1)
8.1.34-9
Fixed
2026-10-22 23:17 UTC
php8.0 (PHP 8.0)
1:8.0.30-25
Fixed
2026-10-22 23:17 UTC
php7.4 (PHP 7.4)
1:7.4.33-31
Fixed
2026-10-22 23:17 UTC

Remi repository (third-party)

Enterprise Linux 10 (remi-modular / remi-safe)

PackageFixed versionStatusAdvisoryLast checked
php:remi-8.5 / php85-php (PHP 8.5)
8.5.12-1.el10.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.4 / php84-php (PHP 8.4)
8.4.27-1.el10.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.3 / php83-php (PHP 8.3)
8.3.36-1.el10.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.2 / php82-php (PHP 8.2)
8.2.35-1.el10.remi
Fixed
2026-10-22 23:17 UTC

Enterprise Linux 9 (remi-modular / remi-safe)

PackageFixed versionStatusAdvisoryLast checked
php:remi-8.5 / php85-php (PHP 8.5)
8.5.12-1.el9.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.4 / php84-php (PHP 8.4)
8.4.27-1.el9.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.3 / php83-php (PHP 8.3)
8.3.36-1.el9.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.2 / php82-php (PHP 8.2)
8.2.35-1.el9.remi
Fixed
2026-10-22 23:17 UTC

Enterprise Linux 8 (remi-modular / remi-safe)

PackageFixed versionStatusAdvisoryLast checked
php:remi-8.5 / php85-php (PHP 8.5)
8.5.12-1.el8.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.4 / php84-php (PHP 8.4)
8.4.27-1.el8.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.3 / php83-php (PHP 8.3)
8.3.36-1.el8.remi
Fixed
2026-10-22 23:17 UTC
php:remi-8.2 / php82-php (PHP 8.2)
8.2.35-1.el8.remi
Fixed
2026-10-22 23:17 UTC

Only use this to check sites you own or are responsible for. Distribution package versions: follow each vendor's security advisory.