https://php2shellcheck.com/fr/status/ Événements officiels datés concernant les correctifs PHP de php2shell : versions, avis des distributions et reconstructions d'images. fr Thu, 22 Oct 2026 23:17:10 GMT https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ 2026-10-22:https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Thu, 22 Oct 2026 00:00:00 GMT AWS updated its php2shell post: it now says it is seeing broad exploitation attempts in the wild (on 21 Oct it said 'being broadly exploited'). It still says it is unclear whether any of these attempts succeeded on real systems. https://www.dreamhoststatus.com/ 2026-10-22:https://www.dreamhoststatus.com/ Thu, 22 Oct 2026 00:00:00 GMT DreamHost says the official PHP security updates have now been applied across its entire network. It has not said whether the fixes it promised for PHP 8.1 and older (PHP Extended Support) were delivered, so we still list it as rolling out. https://status.hosting.com/incident/3174 2026-10-22:https://status.hosting.com/incident/3174 Thu, 22 Oct 2026 00:00:00 GMT A2 Hosting closed its PHP update incident, saying the PHP-related service update has been completed successfully. The closing note names no CVE or PHP versions, so we still list it as rolling out. https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus 2026-10-21:https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus Wed, 21 Oct 2026 00:00:00 GMT CERT.LV, Latvia's national CERT, says automated attempts to exploit the PHP vulnerabilities have been detected in Latvia, with no reports of successful attacks so far. https://secdb.alpinelinux.org/v3.22/community.json 2026-10-22:https://secdb.alpinelinux.org/v3.22/community.json Thu, 22 Oct 2026 00:00:00 GMT Alpine 3.22 published fixed PHP packages in its community repository: php84 8.4.27-r0, php83 8.3.36-r0 and php82 8.2.35-r0, although that repository is past its end-of-support date. https://linux.oracle.com/errata/ELSA-2026-87079.html 2026-10-22:https://linux.oracle.com/errata/ELSA-2026-87079.html Thu, 22 Oct 2026 00:00:00 GMT Oracle published fixed PHP modules for Oracle Linux 9: php:8.3 in ELSA-2026-87079 (8.3.36-1.module+el9.8.0+91082+c865dc1a) and php:8.2 in ELSA-2026-87072 (8.2.35-1.module+el9.8.0+91079+4ad1bd7f). https://errata.almalinux.org/ 2026-10-22:https://errata.almalinux.org/ Thu, 22 Oct 2026 00:00:00 GMT AlmaLinux published fixed PHP packages: AlmaLinux 10 php 8.3.36-1.el10_2 (ALSA-2026:87070) and php8.4 8.4.27-1.el10_2 (ALSA-2026:87071), AlmaLinux 9 php:8.3 (ALSA-2026:87079) and AlmaLinux 8 php:7.4 (ALSA-2026:87080). Its AlmaLinux 9 php:8.2 advisory lists no php package build, so that stream stays unconfirmed. https://status.godaddy.com/ 2026-10-22:https://status.godaddy.com/ Thu, 22 Oct 2026 00:00:00 GMT GoDaddy says all PHP versions on Web Hosting are now patched, so Web Hosting, Managed Hosting for WordPress and Windows Hosting need no customer action. VPS owners still update PHP themselves. https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/ 2026-10-22:https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/ Thu, 22 Oct 2026 00:00:00 GMT Namecheap says its PHP maintenance on shared hosting servers has finished and marked its notice resolved. VPS and dedicated server owners update PHP themselves. https://status.nexcess.net/ 2026-10-22:https://status.nexcess.net/ Thu, 22 Oct 2026 00:00:00 GMT Nexcess says most affected hosts are now patched and patching is underway on the rest. https://apollo.build.resf.org/api/v3/advisories/RLSA-2026:87073 2026-10-22:https://apollo.build.resf.org/api/v3/advisories/RLSA-2026:87073 Thu, 22 Oct 2026 00:00:00 GMT Rocky Linux published RLSA-2026:87073 with a fixed php:8.2 package for Rocky Linux 8: 8.2.35-1.module+el8.10.0+40394+d21b33fb. https://linux.oracle.com/errata/ELSA-2026-87073.html 2026-10-22:https://linux.oracle.com/errata/ELSA-2026-87073.html Thu, 22 Oct 2026 00:00:00 GMT Oracle published fixed PHP modules for Oracle Linux 8: php:8.2 in ELSA-2026-87073 (8.2.35-1.module+el8.10.0+91081+33b5c645) and php:7.4 in ELSA-2026-87080 (7.4.33-8.module+el8.10.0+91080+9785160d). https://secdb.alpinelinux.org/v3.23/community.json 2026-10-22:https://secdb.alpinelinux.org/v3.23/community.json Thu, 22 Oct 2026 00:00:00 GMT Alpine now lists fixed php packages in the repository index for Alpine 3.23 (php85 8.5.12-r0, php84 8.4.27-r0, php83 8.3.36-r0) and Alpine 3.21 (php82 8.2.35-r0). https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-22-al2023-php82-php83.html 2026-10-22:https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-22-al2023-php82-php83.html Thu, 22 Oct 2026 00:00:00 GMT AWS says Elastic Beanstalk Amazon Linux 2023 PHP platform version 4.13.13 now ships PHP 8.3.36 and PHP 8.2.35, after PHP 8.5.12 and 8.4.27 on 21 Oct. Environments need a platform update unless Managed Platform Updates is on. https://statuspage.hostinger.com/ 2026-10-22:https://statuspage.hostinger.com/ Thu, 22 Oct 2026 00:00:00 GMT Hostinger says PHP upgrades are now complete across all managed hosting servers (22 Oct, 06:44 UTC). VPS customers manage PHP themselves. https://www.ionos-status.com/ 2026-10-22:https://www.ionos-status.com/ Thu, 22 Oct 2026 00:00:00 GMT IONOS says it has rolled out the official PHP updates across all platforms it operates itself (incident resolved 22 Oct, 10:10 UTC). Owners of a VPS or dedicated server must update PHP themselves. https://infomaniakstatus.com/p7jX3ML9E1/ 2026-10-22:https://infomaniakstatus.com/p7jX3ML9E1/ Thu, 22 Oct 2026 00:00:00 GMT Infomaniak says the PHP security fixes are deployed on its entire shared Web Hosting and Cloud Server infrastructure for PHP 8.5, 8.4, 8.3, 8.2, 8.1, 8.0 and 7.4. https://status.kinsta.com/ 2026-10-22:https://status.kinsta.com/ Thu, 22 Oct 2026 00:00:00 GMT Kinsta says all sites are protected and the PHP security updates have been rolled out across the platform (incident resolved 22 Oct, 08:26 UTC). https://x.com/ConoHaPR/status/2113239223461417198 2026-10-22:https://x.com/ConoHaPR/status/2113239223461417198 Thu, 22 Oct 2026 00:00:00 GMT ConoHa says in its final report that the security patches are applied to ConoHa WING servers (status as of 20:45 JST on 22 Oct) and customers do not need to change their PHP version. https://status.value-domain.com/information/ 2026-10-22:https://status.value-domain.com/information/ Thu, 22 Oct 2026 00:00:00 GMT Value Domain's notices now say the fix is complete for every PHP version offered on CORESERVER V1 (5.3 to 8.5), CORESERVER V2 (5.2 to 8.5), XREA and VALUESERVER (5.3 to 8.5 each) and One Rental Server (5.6 to 8.5). https://x.com/xserverjp/status/2113242655861940274 2026-10-22:https://x.com/xserverjp/status/2113242655861940274 Thu, 22 Oct 2026 00:00:00 GMT Xserver says on its official X account that fix patches are applied on all target servers for PHP 5.6 to 8.5, and that patches for PHP 5.5 and older are still being created and verified. https://www.kagoya.jp/news/2026102237094/ 2026-10-22:https://www.kagoya.jp/news/2026102237094/ Thu, 22 Oct 2026 00:00:00 GMT KAGOYA says it is updating Rental Server plans to the fixed PHP versions in sequence and expects to finish at 24:00 JST on 22 Oct. https://status.a2hosting.com/ 2026-10-22:https://status.a2hosting.com/ Thu, 22 Oct 2026 00:00:00 GMT A2 Hosting says it is rolling out the upstream PHP security patches on its cPanel/Plesk and Enhance platforms; self-managed server owners must apply the vendor updates themselves. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ 2026-10-21:https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Wed, 21 Oct 2026 00:00:00 GMT AWS (Amazon Threat Intelligence) says php2shell is now being broadly exploited in the wild, and that its honeypot sensors recorded an exploitation attempt dated 17 Oct, four days before disclosure. AWS adds that it is unclear whether those attempts succeeded on real systems. CISA's KEV catalog does not list either CVE as of 22 Oct. https://alas.aws.amazon.com/AL2027/ALAS2027-2026-243.html 2026-10-22:https://alas.aws.amazon.com/AL2027/ALAS2027-2026-243.html Thu, 22 Oct 2026 00:00:00 GMT Amazon published a fixed php8.5 package for the Amazon Linux 2027 Preview: 8.5.12-1.amzn2027.0.1 (ALAS2027-2026-243). https://hostnet.status.io/ 2026-10-22:https://hostnet.status.io/ Thu, 22 Oct 2026 00:00:00 GMT Hostnet says the PHP security update is rolled out on all of its systems, including older PHP versions via PHP Extended Support, and has lifted its temporary measures. https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7 2026-10-22:https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7 Thu, 22 Oct 2026 00:00:00 GMT Hetzner says it has also deployed patches for PHP 5.6 and 7.3 on all Webhosting and Managed Servers, after PHP 7.4 and 8.0 to 8.5. https://status.upsun.com/ 2026-10-22:https://status.upsun.com/ Thu, 22 Oct 2026 00:00:00 GMT Upsun says the PHP security patch has finished deploying to all Dedicated clusters, after updated images reached all grid regions. https://www.cpi.ad.jp/ 2026-10-22:https://www.cpi.ad.jp/ Thu, 22 Oct 2026 00:00:00 GMT CPI says it is urgently applying the latest PHP patches on the versions that have one, and will post an update on versions without a patch. https://access.redhat.com/security/cve/CVE-2026-109618 2026-10-22:https://access.redhat.com/security/cve/CVE-2026-109618 Thu, 22 Oct 2026 00:00:00 GMT Red Hat's CVE pages now list fixed packages. RHEL 10: php 8.3.36-1.el10_2 (RHSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RHSA-2026:87071). RHEL 9: php 8.0.30-8.el9_8.1 (RHSA-2026:87151), php:8.2 (RHSA-2026:87072) and php:8.3 (RHSA-2026:87079). RHEL 8: php:8.2 (RHSA-2026:87073), after php:7.4 (RHSA-2026:87080). RHEL 9 php:8.4 is still listed as Affected with no advisory, and RHEL 7 as 'Under investigation' for CVE-2026-109618 and 'Not affected' for CVE-2026-109619. https://errata.rockylinux.org/RLSA-2026:87070 2026-10-22:https://errata.rockylinux.org/RLSA-2026:87070 Thu, 22 Oct 2026 00:00:00 GMT Rocky Linux published fixed PHP packages. Rocky Linux 10: php 8.3.36-1.el10_2 (RLSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RLSA-2026:87071). Rocky Linux 9: php 8.0.30-8.el9_8.1 (RLSA-2026:87151), php:8.2 (RLSA-2026:87072) and php:8.3 (RLSA-2026:87079). Rocky Linux 8: php:7.4 (RLSA-2026:87080). There is no advisory yet for Rocky Linux 9 php:8.4 or Rocky Linux 8 php:8.2. https://linux.oracle.com/cve/CVE-2026-109618.html 2026-10-22:https://linux.oracle.com/cve/CVE-2026-109618.html Thu, 22 Oct 2026 00:00:00 GMT Oracle's CVE pages list errata for Oracle Linux 10 (ELSA-2026-87070 php 8.3.36-1.el10_2 and ELSA-2026-87071 php8.4 8.4.27-1.el10_2) and Oracle Linux 9 (ELSA-2026-87151 php 8.0.30-8.el9_8.1). They list no php module stream for Oracle Linux 9 and no entry yet for Oracle Linux 8. https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3304.html 2026-10-22:https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3304.html Thu, 22 Oct 2026 00:00:00 GMT Amazon Linux 2023: ALAS2023-2026-3301 to ALAS2023-2026-3304 list fixed packages for php8.2 (8.2.35-1.amzn2023.0.1), php8.3 (8.3.36-1.amzn2023.0.1), php8.4 (8.4.27-1.amzn2023.0.1) and php8.5 (8.5.12-1.amzn2023.0.1). https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-015.html 2026-10-22:https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-015.html Thu, 22 Oct 2026 00:00:00 GMT Amazon Linux 2: ALAS2PHP8.2-2026-015 lists the fixed php 8.2.35-1.amzn2.0.1 packages for the amazon-linux-extras php8.2 stream. https://explore.alas.aws.amazon.com/CVE-2026-109618.html 2026-10-22:https://explore.alas.aws.amazon.com/CVE-2026-109618.html Thu, 22 Oct 2026 00:00:00 GMT Amazon's CVE pages list php8.1 on Amazon Linux 2023 and the Amazon Linux 2 core php package as 'No Fix Planned'; no fixed package is shown for either. https://secdb.alpinelinux.org/edge/community.json 2026-10-22:https://secdb.alpinelinux.org/edge/community.json Thu, 22 Oct 2026 00:00:00 GMT Alpine edge: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community package index. Not every architecture is updated yet (x86, ppc64le, s390x and riscv64 still listed older builds at our check). https://security-tracker.debian.org/tracker/CVE-2026-109618 2026-10-22:https://security-tracker.debian.org/tracker/CVE-2026-109618 Thu, 22 Oct 2026 00:00:00 GMT Debian's security tracker lists php8.4 8.4.27-1 as the fix in unstable (sid) for both CVEs. Testing (forky) still has php8.4 8.4.26-1, which the tracker marks vulnerable. https://deb.freexian.com/extended-lts/tracker/ELA-1853-1 2026-10-22:https://deb.freexian.com/extended-lts/tracker/ELA-1853-1 Thu, 22 Oct 2026 00:00:00 GMT Debian 11 (bullseye): Debian itself has no php7.4 entry for these CVEs because Long Term Support ended on 31 August 2026. Freexian's paid Extended LTS service lists 7.4.33-1+deb11u14 (ELA-1853-1), available only to its subscribers. https://rpms.remirepo.net/enterprise/10/safe/x86_64/ 2026-10-22:https://rpms.remirepo.net/enterprise/10/safe/x86_64/ Thu, 22 Oct 2026 00:00:00 GMT Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 10, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. https://rpms.remirepo.net/enterprise/9/safe/x86_64/ 2026-10-22:https://rpms.remirepo.net/enterprise/9/safe/x86_64/ Thu, 22 Oct 2026 00:00:00 GMT Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 9, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. https://rpms.remirepo.net/enterprise/8/safe/x86_64/ 2026-10-22:https://rpms.remirepo.net/enterprise/8/safe/x86_64/ Thu, 22 Oct 2026 00:00:00 GMT Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 8, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. https://jvn.jp/vu/JVNVU99905564/ 2026-10-22:https://jvn.jp/vu/JVNVU99905564/ Thu, 22 Oct 2026 00:00:00 GMT JVN (JPCERT/CC and IPA) published vulnerability note JVNVU#99905564 for both CVEs. It points to the PHP Group advisory and does not name fixed versions itself. https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619 2026-10-22:https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619 Thu, 22 Oct 2026 00:00:00 GMT The Canadian Centre for Cyber Security published alert AL26-026 listing the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says a proof of concept is reported in open sources and that it has identified no active exploitation at this time. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ 2026-10-22:https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Thu, 22 Oct 2026 00:00:00 GMT The PHP Foundation says proof-of-concept code circulated more widely on 21 October, and that its security team did not identify any functional exploits at the time of release. https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do 2026-10-22:https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do Thu, 22 Oct 2026 00:00:00 GMT GoDaddy says Managed Hosting for WordPress is fully patched and needs no action. Web Hosting and Windows Hosting are mitigated while it waits for patched packages from its vendor, and VPS owners must update PHP themselves. https://wpenginestatus.com/ 2026-10-22:https://wpenginestatus.com/ Thu, 22 Oct 2026 00:00:00 GMT WP Engine says it has finished deploying the PHP security patches on its platform and no action is needed (updated builds named: 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12). https://status.cloudways.com/ 2026-10-22:https://status.cloudways.com/ Thu, 22 Oct 2026 00:00:00 GMT Cloudways says patches are applied for all customer applications on its Autonomous product and are still rolling out for applications on Flexible. https://status.liquidweb.com/incidents/6bfpxwg75xgj 2026-10-22:https://status.liquidweb.com/incidents/6bfpxwg75xgj Thu, 22 Oct 2026 00:00:00 GMT Liquid Web published its patched build numbers (cPanel PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Plesk v18.0.81.4) and says patched builds are still being deployed across its infrastructure. Customers who are not patched yet should run a package update in their control panel. https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now 2026-10-22:https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now Thu, 22 Oct 2026 00:00:00 GMT DigitalOcean says the App Platform PHP buildpack is patched. You must redeploy your app to pick it up, and apps built from your own Dockerfile or image need PHP updated in that image. https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-21-al2023-php84-php85.html 2026-10-22:https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-21-al2023-php84-php85.html Thu, 22 Oct 2026 00:00:00 GMT AWS Elastic Beanstalk released Amazon Linux 2023 PHP 8.5 and PHP 8.4 platform versions (4.13.13) with PHP 8.5.12 and 8.4.27. A later release is to update the PHP 8.3 and PHP 8.2 platform branches. https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.html 2026-10-22:https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.html Thu, 22 Oct 2026 00:00:00 GMT AWS published Lightsail guidance for updating PHP yourself. Instances from Lightsail-packaged blueprints update PHP with the package manager; Bitnami-blueprint instances keep their own copy of PHP that apt upgrade does not update. AWS lists the fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. https://www.netcup-status.de/ 2026-10-22:https://www.netcup-status.de/ Thu, 22 Oct 2026 00:00:00 GMT netcup says all Webhosting packages (including Reseller) and all Managed Servers are patched and online. Root server, VPS and managed cloud cluster customers must patch PHP themselves. https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 2026-10-22:https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 Thu, 22 Oct 2026 00:00:00 GMT CloudLinux says its release of fixed alt-php packages is complete (22 October, 00:07 UTC) and a regular update installs them, followed by a PHP restart. The packages carry the fix as a backport and keep their own lower version numbers, so check the package changelog. https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk 2026-10-22:https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk Thu, 22 Oct 2026 00:00:00 GMT Plesk says its own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4, and asks customers to update Plesk to the latest available version. https://www.aapanel.com/forum/d/26249-critical-php-security-update 2026-10-22:https://www.aapanel.com/forum/d/26249-critical-php-security-update Thu, 22 Oct 2026 00:00:00 GMT aaPanel now says patches are available in its App Store for PHP 7.4 to 8.5; update each installed PHP version there. Users on PHP 7.3 or older are pointed to configuration mitigation only. https://help.sakura.ad.jp/notification/n-2700 2026-10-22:https://help.sakura.ad.jp/notification/n-2700 Thu, 22 Oct 2026 00:00:00 GMT Sakura Internet says the fix is complete for every PHP version selectable in the Rental Server and Managed Server control panel. phpMyAdmin and webmail used by some services are still being handled. https://x.com/lolipopjp/status/2113121114809684114 2026-10-22:https://x.com/lolipopjp/status/2113121114809684114 Thu, 22 Oct 2026 00:00:00 GMT GMO Pepabo says on its official X account that Lolipop has the fixed version applied and customer sites were restored at 13:11 JST on 22 October. It also applied its own fixes to older PHP versions that have no official fix. https://heteml.jp/info/detail/id/2953 2026-10-22:https://heteml.jp/info/detail/id/2953 Thu, 22 Oct 2026 00:00:00 GMT GMO Pepabo says heteml has the official fixed versions for the PHP 8 series and PHP 7.4, and its own fix for all other versions. Some functions are disabled on PHP 8.1 and below. https://secure.colorfulbox.jp/announcements/231/%E9%87%8D%E8%A6%81PHP%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E5%AF%BE%E3%81%99%E3%82%8B%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3%E3%82%A2%E3%83%83%E3%83%97%E3%83%87%E3%83%BC%E3%83%88%E5%AE%8C%E4%BA%86%E3%81%AE%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B%E3%81%8A%E5%AE%A2%E6%A7%98%E3%81%A7%E3%81%AE%E3%83%90%E3%83%BC%E3%82%B8%E3%83%A7%E3%83%B3%E5%A4%89%E6%9B%B4%E4%BD%9C%E6%A5%AD%E3%81%AF%E4%B8%8D%E8%A6%81%E3%81%A7%E3%81%99.html 2026-10-22:https://secure.colorfulbox.jp/announcements/231/%E9%87%8D%E8%A6%81PHP%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E5%AF%BE%E3%81%99%E3%82%8B%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3%E3%82%A2%E3%83%83%E3%83%97%E3%83%87%E3%83%BC%E3%83%88%E5%AE%8C%E4%BA%86%E3%81%AE%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B%E3%81%8A%E5%AE%A2%E6%A7%98%E3%81%A7%E3%81%AE%E3%83%90%E3%83%BC%E3%82%B8%E3%83%A7%E3%83%B3%E5%A4%89%E6%9B%B4%E4%BD%9C%E6%A5%AD%E3%81%AF%E4%B8%8D%E8%A6%81%E3%81%A7%E3%81%99.html Thu, 22 Oct 2026 00:00:00 GMT ColorfulBox says the security fix is complete on all its servers as of the morning of 22 October, and customers do not need to change their PHP version. https://mixhost.jp/news/1974 2026-10-22:https://mixhost.jp/news/1974 Thu, 22 Oct 2026 00:00:00 GMT mixhost says it finished applying the PHP fix packages on all its rental servers at about 10:18 JST on 22 October (PHP 5.2 to 8.5). The PHP version number shown does not change, and no customer action is needed. https://www.conoha.jp/wing/news/?ap=2015054903 2026-10-22:https://www.conoha.jp/wing/news/?ap=2015054903 Thu, 22 Oct 2026 00:00:00 GMT ConoHa says it is applying security patches to ConoHa WING servers in sequence and keeping each customer's current PHP version. https://www.onamae.com/news/article/11591 2026-10-22:https://www.onamae.com/news/article/11591 Thu, 22 Oct 2026 00:00:00 GMT GMO Internet says it is applying security patches to Onamae.com Rental Server servers in sequence and keeping each customer's current PHP version. A change may be needed for some customers on PHP 5.x or 7.x. https://status.value-domain.com/information/detail/?info_id=916 2026-10-22:https://status.value-domain.com/information/detail/?info_id=916 Thu, 22 Oct 2026 00:00:00 GMT Value Domain's status page says the fix is complete on CORESERVER V2 for every PHP version it offers, and on CORESERVER V1 for PHP 7.4 and later. Older PHP versions on V1 are not mentioned. https://status.value-domain.com/information/detail/?info_id=919 2026-10-22:https://status.value-domain.com/information/detail/?info_id=919 Thu, 22 Oct 2026 00:00:00 GMT Value Domain's status page says the fix is complete on XREA for PHP 7.4 and later. Older PHP versions are not mentioned. https://status.value-domain.com/information/detail/?info_id=918 2026-10-22:https://status.value-domain.com/information/detail/?info_id=918 Thu, 22 Oct 2026 00:00:00 GMT Value Domain's status page says the fix is complete on VALUESERVER for PHP 7.4 and later. Older PHP versions are not mentioned. https://status.value-domain.com/information/detail/?info_id=920 2026-10-22:https://status.value-domain.com/information/detail/?info_id=920 Thu, 22 Oct 2026 00:00:00 GMT Value Domain's status page says the fix is complete on One Rental Server for PHP 8.0 and later. Older PHP versions are not mentioned. https://help.arena.ne.jp/hc/ja/articles/44408280593303 2026-10-22:https://help.arena.ne.jp/hc/ja/articles/44408280593303 Thu, 22 Oct 2026 00:00:00 GMT NTTPC published a notice for WebARENA SuiteX naming both CVEs. Web access from outside Japan is restricted and one PHP function (file-upload progress) is disabled as mitigations; the notice does not say a PHP fix has been applied. https://access.redhat.com/errata/RHSA-2026:87080 2026-10-21:https://access.redhat.com/errata/RHSA-2026:87080 Wed, 21 Oct 2026 00:00:00 GMT Red Hat released RHSA-2026:87080 for RHEL 8 php:7.4 (7.4.33-8.module+el8.10.0+25117+30337cca), which fixes both CVEs. https://secdb.alpinelinux.org/v3.24/community.json 2026-10-21:https://secdb.alpinelinux.org/v3.24/community.json Wed, 21 Oct 2026 00:00:00 GMT Alpine 3.24: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community repository. On Alpine edge, php83 8.3.36-r0 is listed in the security database but the package is not in the repository yet. https://formulae.brew.sh/api/formula/php.json 2026-10-21:https://formulae.brew.sh/api/formula/php.json Wed, 21 Oct 2026 00:00:00 GMT Homebrew: php is now 8.5.12, php@8.4 is 8.4.27, php@8.3 is 8.3.36 and php@8.2 is 8.2.35. https://nvd.nist.gov/vuln/detail/CVE-2026-109618 2026-10-21:https://nvd.nist.gov/vuln/detail/CVE-2026-109618 Wed, 21 Oct 2026 00:00:00 GMT NVD added its own CVSS 3.1 score of 9.8 (Critical) for both CVEs, and its affected-version data now also covers PHP versions older than 8.2.35. https://laravel.com/blog/php-critical-vulnerability-response-updates 2026-10-21:https://laravel.com/blog/php-critical-vulnerability-response-updates Wed, 21 Oct 2026 00:00:00 GMT Laravel Cloud says every running application is now patched (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35). https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7 2026-10-21:https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7 Wed, 21 Oct 2026 00:00:00 GMT Hetzner says PHP 7.4 and 8.0 to 8.5 are patched on all Webhosting and Managed Servers. https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk 2026-10-21:https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk Wed, 21 Oct 2026 00:00:00 GMT OVHcloud says PHP 7.4 to 8.5 are patched on all Web Hosting clusters. https://status.getflywheel.com/ 2026-10-21:https://status.getflywheel.com/ Wed, 21 Oct 2026 00:00:00 GMT Flywheel says patching of its platform is finished and no customer action is needed. https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html 2026-10-21:https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html Wed, 21 Oct 2026 00:00:00 GMT Azure App Service finished rolling out patched PHP images to the Latest and Standard channels (8.2.35, 8.3.36, 8.4.27, 8.5.12). https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk 2026-10-21:https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk Wed, 21 Oct 2026 00:00:00 GMT Plesk now has PHP 8.2 to 8.5 fixes for Windows too, and says rebuilt 7.4, 8.0 and 8.1 packages on Linux include the fix. https://forum.directadmin.com/threads/critical-php-updates.82726/post-402495 2026-10-21:https://forum.directadmin.com/threads/critical-php-updates.82726/post-402495 Wed, 21 Oct 2026 00:00:00 GMT DirectAdmin released a further build with patches for PHP 7.3 down to 5.6. https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 2026-10-21:https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 Wed, 21 Oct 2026 00:00:00 GMT CloudLinux released more fixed alt-php builds (alt-php74, alt-php80 and alt-php81 on more platforms); other versions are still in preparation. https://www.webuzo.com/blog/webuzo-patched-emps-cve-2026-109618-109619/ 2026-10-21:https://www.webuzo.com/blog/webuzo-patched-emps-cve-2026-109618-109619/ Wed, 21 Oct 2026 00:00:00 GMT Webuzo published patched EMPS packages and tells users to run the EMPS update command. CyberPanel says fixed LiteSpeed PHP packages (8.2.35, 8.3.36, 8.4.27, 8.5.12) are available and administrators must update. https://security-tracker.debian.org/tracker/DSA-6574-1 2026-10-21:https://security-tracker.debian.org/tracker/DSA-6574-1 Wed, 21 Oct 2026 00:00:00 GMT Debian's security tracker lists fixed php8.4 packages for Debian 13 (DSA-6574-1) and php8.2 packages for Debian 12 (DLA-4848-1). https://hub.docker.com/_/php 2026-10-21:https://hub.docker.com/_/php Wed, 21 Oct 2026 00:00:00 GMT The official Docker php images were rebuilt with PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. https://ubuntu.com/security/notices/USN-8948-1 2026-10-21:https://ubuntu.com/security/notices/USN-8948-1 Wed, 21 Oct 2026 00:00:00 GMT Ubuntu published USN-8948-1 and USN-8948-2 with fixed PHP packages (Ubuntu 20.04 and older through Ubuntu Pro). https://www.php.net/archive/2026.php#2026-10-21-5 2026-10-21:https://www.php.net/archive/2026.php#2026-10-21-5 Wed, 21 Oct 2026 00:00:00 GMT php.net released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619.