PHP 7.4, 8.0 and 8.1 are end-of-life: what is patched and what to do

Only check systems you own or are responsible for.

Short answer

php.net fixed the two critical php2shell flaws (CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution) in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. It published no new release for 7.4, 8.0 or 8.1.

Those branches are patched only if your OS vendor or repository back-ported the fix. Check your vendor’s fixed package version, never the PHP number alone. If you have no vendor fix, treat the server as affected and upgrade to a supported branch.

Status as of 22 Oct 2026. Vendor pages are still changing, so re-check them.

What php.net says about the EOL branches

From the php.net security advisory:

PHP 8.1 and older no longer receive updates from the PHP project.

The advisory also notes that distribution and LTS vendors may ship their own backports. That part is our paraphrase, not a php.net quotation. For a vendor package, ask your vendor, or move to a supported branch.

Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.

The same advisory says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The French CERT (CERT-FR) lists PHP 5.x through 8.1.x as affected. The PHP Group’s own CVE records and the GitHub advisories list only 8.2 to 8.5, but NVD’s product data now matches every PHP version below 8.2.35, so 8.1 and older too.

Dates come from php.net/eol.php. The source branches are PHP-7.4-CVE-2026-109618-109619, PHP-8.0-CVE-2026-109618-109619 and PHP-8.1-CVE-2026-109618-109619 in php-src. The announcement mentions no backport for PHP 7.3 and older.

Which vendors do cover them

Distro packages keep their old version numbers because fixes are back-ported. Compare your installed package with the vendor’s fixed package version below, not with the upstream number.

Notes on the table:

• Ubuntu Pro is Canonical’s subscription. Canonical says it is free for personal use. Without it, a 20.04 machine does not receive the ESM fix.
• sury.org and ondrej/php are third-party repositories by the Debian PHP maintainer, not the distro’s own archive. Their changelogs name both CVEs as “Avoid state corruption via bailout”.
• Remi (RPM): php.net said on 21 Oct that the volunteer-maintained rpms.remirepo.net “will not have updates today”. By 22 Oct 2026 Remi had 8.2.35 to 8.5.12 builds for Enterprise Linux 8, 9 and 10, but we have not confirmed a fixed 7.4, 8.0 or 8.1 package there.
• AlmaLinux: for php:7.4 on AlmaLinux 8 it lists 7.4.33-8.module_el8.10.0+4321+cf5fd4bb (ALSA-2026:87080); we found no advisory for AlmaLinux 9 php 8.0 and show it as unconfirmed. Oracle Linux 8 has an advisory only for php:7.4 and php:8.2, and apart from the Red Hat, Rocky Linux, Oracle Linux and AlmaLinux rows above, we have no fixed package for PHP 7.4, 8.0 or 8.1 from those vendors. See fixed versions and hosting status for the current picture.

Check and apply a vendor fix (Ubuntu / Debian family)

# 1. What is installed (adjust php8.1 to your branch)
dpkg-query -W -f='${Package} ${Version}\n' 'php8.1*' | head

# 2. Take a snapshot/backup first, then update
sudo apt update
sudo apt install --only-upgrade 'php8.1*' 'libapache2-mod-php8.1'

# 3. Restart whatever serves PHP (run only the services you have)
sudo systemctl restart php8.1-fpm
sudo systemctl restart apache2

# 4. Verify: prints OK only if installed >= the vendor's fixed version
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.1-common)" ge '8.1.2-1ubuntu2.28' && echo OK || echo STILL-OLD

Replace the version string in step 4 with the fixed version for your branch from the table. With --only-upgrade, apt skips packages you do not have installed (for example the Apache module on an FPM setup).

On Ubuntu 20.04, attach Ubuntu Pro first, then run the same update:

sudo pro attach <YOUR_TOKEN>      # token from your Ubuntu Pro account
sudo pro status                   # esm-infra should be "enabled"
sudo apt update && sudo apt install --only-upgrade 'php7.4*'

If there is no vendor fix: build from the php.net source branch

This is a stopgap for people with no other option. php.net calls these “minimal” source backports for branches that no longer receive updates.

php -i | grep 'Configure Command'      # reuse your existing configure flags
git clone --depth 1 --branch PHP-8.1-CVE-2026-109618-109619 https://github.com/php/php-src.git
git -C php-src log -1 --format=%H      # record this in your change log

When we checked on 22 Oct 2026, the tip commits were 712e60f9edfd… (7.4), 82f8f31b16a0… (8.0) and 1d7dec178a09… (8.1). Rebuild with your old flags, install, then restart php-fpm or Apache. php -v will still say 7.4.33, 8.0.30 or 8.1.34, because the branch has no new version number. That is why a version number alone proves nothing here: keep your own record of the commit you built.

Upgrade to a supported branch (recommended)

On 22 Oct 2026, php.net’s supported versions list security support until 31 Dec 2026 for 8.2, 31 Dec 2027 for 8.3, 31 Dec 2028 for 8.4 and 31 Dec 2029 for 8.5. 8.2 is the minimum fixed branch but runs out soonest, so aim for 8.4 or 8.5 if your software allows.

1. Back up first. Snapshot the server (or database plus files) before a major-version upgrade.

2. Build a staging copy with the same OS, extensions and web server config. Do not test on production.

3. Check compatibility. Update your CMS, framework and plugins to releases that support the target PHP. Then:

   # Run these with the NEW php binary (for example php8.4)
   php8.4 "$(command -v composer)" check-platform-reqs
   composer why-not php 8.4
   find . -name '*.php' -not -path './vendor/*' -print0 | xargs -0 -n1 php8.4 -l | grep -v '^No syntax errors'
   php -m                                       # run on the OLD server, then compare with php8.4 -m

   Run your test suite or click through key pages with error_reporting=E_ALL, logging errors to a file. Static tools such as PHPStan and PHPCompatibility can help. Read the php.net migration guides for each step: 8.0, 8.1, 8.2, 8.3, 8.4, 8.5.

4. Install the new branch alongside the old one. Ubuntu 24.04 ships PHP 8.3 (fixed in 8.3.6-0ubuntu0.24.04.13). For 8.4 or 8.5 on Ubuntu, ppa:ondrej/php is a third-party option:

   sudo add-apt-repository ppa:ondrej/php && sudo apt update
   sudo apt install php8.4-fpm php8.4-cli   # add the extensions from `php -m`

5. Switch traffic. For nginx, point fastcgi_pass to unix:/run/php/php8.4-fpm.sock, then sudo nginx -t && sudo systemctl reload nginx. For Apache with mod_php: sudo a2dismod php8.1 && sudo a2enmod php8.4 && sudo systemctl restart apache2.

6. Verify the web server, not just the CLI. php -v only shows the command-line binary. Confirm the service you switched to is the one running:

   systemctl is-active php8.4-fpm
   dpkg-query -W -f='${Version}\n' php8.4-fpm

   Confirm the version is at least 8.4.27 (or the vendor’s fixed package version), then stop the old service (sudo systemctl disable --now php8.1-fpm) once the site is stable. Keep the old packages installed until then so you can roll back.

7. Re-check with the checker by typing your version and platform.

Interim measures are not a fix

php.net’s advisory lists some configuration and web-server limits, but says they “reduce exposure to specific attack paths but do not make an installation safe”. Its release notices add: “There are no complete mitigations, updating is the only safe choice.” Use the limits only while you plan the update, and read the list on php.net.

Not sure which row applies to your setup? Our $49 personal patch plan gives you written steps for your exact setup by email within 24h: see the fix service.

Independent site, not affiliated with the PHP Group or php.net.